<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hi Peter,<BR> <BR>Thanks for the reply, my answers inline<br> <BR><div>> Date: Wed, 4 Nov 2015 14:03:51 +0100<br>> From: peter.schober@univie.ac.at<br>> To: users@shibboleth.net<br>> Subject: Re: ECP Practical issue<br>> <br>> * lalith jayaweera <j_lalith@hotmail.com> [2015-11-04 13:05]:<br>> > but my question is in the authentication block it self, that is, in<br>> > the absence of full UPN from Office 365 during the authentication<br>> > flow, how to mimic it as the email address and authenticate against<br>> > the email attribute in LDAP.<br>> <br>> That's one question: You want subjects to authenticate using their<br>> email address (used as unique identifier) but this should also work if<br>> httpd is only provided with a part of the string (the local part)?<br>> I doubt httpd's module have that capability (conditionally adding a<br>> static string to the username provided during HTTP Basic Auth /before/<br>> passing it to a module for processing) but that's definitively not a<br>> Shibboleth question.</div><div> </div><div>Yes do agree, don't think below ldap auth handler capable of massaging the username prior.</div><div><br>> <br>> > because as per my understanding, only local part of UPN becomes the<br>> > username for the Apache LDAP auth handler in IdP during the<br>> > office365 flow of execution not the full UPN which is the email<br>> > address.<br>> <br>> That's a different question: You're saying even if the full email<br>> address is supplied to httpd during HTTP Basic Auth, only a part of<br>> the supplied string becomes REMOTE_USER in httpd? I very much doubt<br>> this (and that would be a bug in httpd or the relevant module), but<br>> again, this has nothing to do whatsoever with Shibboleth.</div><div> </div><div>No I am not telling it a httpd bug, because even in the non-webclient auth request the username carry only the local part of UPN (email), I guess that is how Office365 works with ECP in this whole interaction.</div><div><br>> <br>> The Shib project hasn't recommended (or even documented) to use Apache<br>> httpd with the IDP in a long time, and the current IDP (v3) even takes<br>> care of ECP out of the box, using the same auth methods configured for<br>> WebSSO uses.</div><div> </div><div>I guess all Shibboleth wants is REMOTE_USER populated after the Authentication isn't it?</div><div> </div><div> </div><div>In general, this UPN issue is a common issue in Office 365 world, for institutions where they cannot change UPN to facilitate above, there are other ways to do via 'Configuring Alternate Login'.</div><div> </div><div>My understanding is that option is only with ADFS not with Shibboleth .</div><div> </div><div>Lot of above doubts possible not direct Shibboleth questions but I guess Shibboleth is still one piece in the same puzzle and possible someone already experienced above.</div><div><br> </div> </div></body>
</html>