<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Feb 17, 2016, at 2:53 PM, Rob Gorrell <<a href="mailto:rwgorrel@uncg.edu" class="">rwgorrel@uncg.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class=""><span class=""></span>
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br class="">
<div bgcolor="#FFFFFF" text="#000000" class=""><span class="">
<blockquote type="cite" class="">
<pre class="">Without commenting on how clueless MS support is, they are asking me to try a CA signed certificate for the SAML signing certificate (instead of the normal self-signed cert created at installation). So some questions in case someone else has had to bang their head against the O365 wall:</pre>
</blockquote>
<br class="">
</span>I know literally zero about Office 365, so I have no idea how their trust works and what they really require. Do you supply a metadata XML document? Do you upload a key + other info to a mgmt UI on the MS side?
<span class=""></span></div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">no metadata XML, you upload a 1. domain, 2. url (binding), 3. ecp url (binding), 4. uri (entityID), 5. logout url, and 6. base64 encoded x509 cert. to my knowledge, O365 will only do signing, no encryption of the assertion.<br class="">
<br class="">
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<div class=""><br class="">
</div>
Yea, it’s ugly, full details as documented by MS: <a href="https://msdn.microsoft.com/en-us/library/azure/jj205457.aspx" class="">https://msdn.microsoft.com/en-us/library/azure/jj205457.aspx</a>
<div class=""><br class="">
</div>
<div class="">You use a Windows PowerShell command to tell Azure/Office365 to do SAML. There is no management interface to use. Then you get oh so friendly and useful error messages like this:</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">PS C:\Users\Administrator\Desktop> Set-MsolDomainAuthentication -DomainName $dom -FederationBrandName $dom -Authentication Federated -PassiveLogOnUri $url -SigningCertificate $cert -IssuerUri $uri -ActiveLogOnUri $ecpUrl -LogOffUri $logouturl
-PreferredAuthenticationProtocol SAMLP</div>
<div class="">Set-MsolDomainAuthentication : Unable to complete this action. Try again later.</div>
<div class="">At line:1 char:29</div>
<div class="">+ Set-MsolDomainAuthentication <<<< -DomainName $dom -FederationBrandName $dom -Authentication Federated -PassiveLogOnUri $url -SigningCertificate $cert -IssuerUri $uri -ActiveLogOnUri $ecpUrl -LogOffUri $logouturl -PreferredAuthenticationProtocol
SAMLP</div>
<div class=""> + CategoryInfo : OperationStopped: (:) [Set-MsolDomainAuthentication], MicrosoftOnlineException</div>
<div class=""> + FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.InternalServiceException,Microsoft.Online.Administration.Automation.SetDomainAuthentication</div>
<div class=""><br class="">
</div>
</div>
<div class="">At this point, you supply MS support with useless information as they are apparently unable or unwilling to look into their own systems to find a real cause.</div>
<div class=""><br class="">
</div>
<div class="">Paul</div>
<div class=""><br class="">
<div class="">-----<br class="">
Paul Hethmon<br class="">
Chief Software Architect<br class="">
<a href="mailto:paul.hethmon@clareitysecurity.com" class="">paul.hethmon@clareitysecurity.com</a><br class="">
<br class="">
</div>
<br class="">
</div>
</body>
</html>