<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 2/17/16 3:11 PM, Paul Hethmon wrote:<br>
</div>
<blockquote
cite="mid:5D67E585-A753-4A90-B4DA-3F311D4D9F2F@clareitysecurity.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<span class=""></span>
<div>
<blockquote type="cite" class="">
<div class="">
<div dir="ltr" class="">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
</blockquote>
<div class=""><br class="">
</div>
<div class="">no metadata XML, you upload a 1. domain,
2. url (binding), 3. ecp url (binding), 4. uri
(entityID), 5. logout url, and 6. base64 encoded
x509 cert. to my knowledge, O365 will only do
signing, no encryption of the assertion.<br class="">
<br class="">
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</blockquote>
<br>
Ok. I think that answers the original question: If there's no
metadata being sent to MS, then no, I don't think you'd have to do
anything re: metadata, since they're not using it.<br>
<br>
<blockquote
cite="mid:5D67E585-A753-4A90-B4DA-3F311D4D9F2F@clareitysecurity.com"
type="cite">
<div>
<blockquote type="cite" class="">
<div class="">
<div dir="ltr" class="">
<div class="gmail_extra">
<div class="gmail_quote">
<div class="">
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<div class=""><br>
<div class="">+ Set-MsolDomainAuthentication <<<<
-DomainName $dom -FederationBrandName $dom -Authentication
Federated -PassiveLogOnUri $url -SigningCertificate $cert
-IssuerUri $uri -ActiveLogOnUri $ecpUrl -LogOffUri $logouturl
-PreferredAuthenticationProtocol SAMLP</div>
<div class=""> + CategoryInfo : OperationStopped:
(:) [Set-MsolDomainAuthentication], MicrosoftOnlineException</div>
<div class=""> + FullyQualifiedErrorId :
Microsoft.Online.Administration.Automation.InternalServiceException,Microsoft.Online.Administration.Automation.SetDomainAuthentication</div>
<div class=""><br class="">
</div>
</div>
<div class="">At this point, you supply MS support with useless
information as they are apparently unable or unwilling to look
into their own systems to find a real cause.<br>
</div>
<br>
</blockquote>
<br>
<br>
Yeah, nothing useful there. You have no access to any logs on the
service side? Maybe they really do only support a CA-issued cert for
some reason, who knows. Or is there some sort of mismatch between
the domain you are specifying in the call and the CN in the cert?
Otherwise I have no suggestions. <br>
<br>
<br>
</body>
</html>