<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Feb 17, 2016, at 3:32 PM, Brent Putman <<a href="mailto:putmanb@georgetown.edu" class="">putmanb@georgetown.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div bgcolor="#FFFFFF" text="#000000" class="">
<blockquote cite="mid:5D67E585-A753-4A90-B4DA-3F311D4D9F2F@clareitysecurity.com" type="cite" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class="">
<div class="">
<div class=""><br class="Apple-interchange-newline">
+ Set-MsolDomainAuthentication <<<< -DomainName $dom -FederationBrandName $dom -Authentication Federated -PassiveLogOnUri $url -SigningCertificate $cert -IssuerUri $uri -ActiveLogOnUri $ecpUrl -LogOffUri $logouturl -PreferredAuthenticationProtocol SAMLP</div>
<div class=""> + CategoryInfo : OperationStopped: (:) [Set-MsolDomainAuthentication], MicrosoftOnlineException</div>
<div class=""> + FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.InternalServiceException,Microsoft.Online.Administration.Automation.SetDomainAuthentication</div>
<div class=""><br class="">
</div>
</div>
<div class="">At this point, you supply MS support with useless information as they are apparently unable or unwilling to look into their own systems to find a real cause.<br class="">
</div>
<br class="">
</blockquote>
<br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class="">
<br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class="">
<span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">Yeah,
nothing useful there. You have no access to any logs on the service side? Maybe they really do only support a CA-issued cert for some reason, who knows. Or is there some sort of mismatch between the domain you are specifying in the call and the CN in the
cert? Otherwise I have no suggestions. <span class="Apple-converted-space"> </span></span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class="">
</div>
</div>
</blockquote>
</div>
<div class=""><br class="">
</div>
<div class="">I actually did have a mismatch on CN originally, but regenerated the cert to match them up.</div>
<div class=""><br class="">
</div>
<div class="">What kills me is that I had it working on a different IdP last fall, all I did is try to move it to a new IdP. Both using the same version of Shib (2.4) and both installed/created the same.</div>
<br class="">
<div class="">-----<br class="">
Paul Hethmon<br class="">
Chief Software Architect<br class="">
<a href="mailto:paul.hethmon@clareitysecurity.com" class="">paul.hethmon@clareitysecurity.com</a><br class="">
<br class="">
</div>
<br class="">
</body>
</html>