<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>I can confirm that O365 fully works with IDPv3, including ECP and all of the Office Online stuff (including Skype, although you have to get ADAL enabled through a MSConnect program because it's not GA yet).
<br>
</p>
<br>
<p>We have this written up in anticipation of a talk at OHECC (we host it this year) but not quite ready yet .. but here is the O365 side highlights :<br>
</p>
<p><br>
</p>
<p>Here is the link to the connect program for ADAL in SfB : <a title="Ctrl+Click or tap to follow the link" id="LPlnk948410" href="http://aka.ms/PublicPreview">
http://aka.ms/PublicPreview</a></p>
<p><br>
</p>
<p>You should open a PSS ticket concurrent with that form so your account manager can track the progress .. it will take a couple weeks (about 3 for us, did it Dec of 2015).</p>
<p><br>
</p>
<p>Here is what you have to do in the tenant :</p>
<p>(this does not actually break anything, you can easily move it back to ADFS .. but that said, I would try this in your DEV tenant first, YMMV, batteries not included).
</p>
<p><br>
-remove existing federation<br>
Convert-MsolDomainToStandard -DomainName whtever.edu -SkipUserConversion<br>
<br>
-add new one<br>
NOTE: below, the $cert had to be created thusly:<br>
openssl x509 -in idp-signing.crt -outform der |openssl enc -base64 |tr -d '\n'<br>
<br>
-below is pasted into msol powershell<br>
$dom = “whatever.edu”<br>
$url = "https://whatever.edu/idp/profile/SAML2/POST/SSO"<br>
$ecpUrl = "https://whatever.edu/idp/profile/SAML2/SOAP/ECP"<br>
$uri = "https://whatever.edu/idp/shibboleth"<br>
$logouturl = "https://whatever.edu/path/to/stuff" <br>
$cert = “DER_ENCODED_CERT_GOES_HERE”<br>
<br>
-this actually does the dirty .. should produce no output or errors. <br>
Set-MsolDomainAuthentication –DomainName $dom -FederationBrandName $dom -Authentication Federated -PassiveLogOnUri $url -SigningCertificate $cert -IssuerUri $uri -ActiveLogOnUri $ecpUrl -LogOffUri $logouturl -PreferredAuthenticationProtocol SAMLP<br>
<br>
</p>
<p>Regards,</p>
<p><br>
</p>
<p>Michael Holstein</p>
<p>Cleveland State University<br>
</p>
<p><br>
</p>
<div style="color: rgb(49, 55, 57);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Paul Hethmon <paul.hethmon@clareitysecurity.com><br>
<b>Sent:</b> Wednesday, February 17, 2016 4:39 PM<br>
<b>To:</b> Shibboleth Users<br>
<b>Subject:</b> Re: off-topic help for Office 365</font>
<div> </div>
</div>
<div><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Feb 17, 2016, at 4:14 PM, David Gersic <<a href="mailto:dgersic@niu.edu" class="">dgersic@niu.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="" style="margin-top:0px; margin-bottom:0px; font-family:Calibri,Arial,Helvetica,sans-serif; font-size:16px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; background-color:rgb(255,255,255)">
I know a little bit about Office365, and a little bit about Shib. Does "had it working" mean that you successfully federated your Office365 tenant with your local Shibboleth IdP? No other things like ADFS being involved?</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>No ADFS involved. Our primary product here at Clareity is an IAM system. So I federated to my IAM system via Shibboleth/SAML.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="" style="margin-top:0px; margin-bottom:0px; font-family:Calibri,Arial,Helvetica,sans-serif; font-size:16px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; background-color:rgb(255,255,255)">
<br class="">
</div>
<div class="" style="margin-top:0px; margin-bottom:0px; font-family:Calibri,Arial,Helvetica,sans-serif; font-size:16px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; background-color:rgb(255,255,255)">
If so, does "had" mean that you ran the PowerShell commands to un-federate your tenant and have being using Office365's native authentication? If so, did that un-federate actually complete successfully? If it didn't, then you may be hitting an error trying
to federate a tenant that thinks that it is already federated.</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>This actually bit me to start, but I unfederated it. To really make sure, I removed that original domain from Office365 entirely and added the new one. I also have the “<a href="http://onmicrosoft.com" class="">onmicrosoft.com</a>” domain set as the default
since you can’t federate a domain that is the default in O365.</div>
<br class="">
<blockquote type="cite" class="">
<div class=""><br class="Apple-interchange-newline">
</div>
</blockquote>
</div>
<br class="">
<div class="">-----<br class="">
Paul Hethmon<br class="">
Chief Software Architect<br class="">
<a href="mailto:paul.hethmon@clareitysecurity.com" class="">paul.hethmon@clareitysecurity.com</a><br class="">
<br class="">
</div>
<br class="">
</div>
</div>
</div>
</body>
</html>