<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Some of this just doesn't make any sense yet, so I'm throwing it out
here to see if something similar has happened...<br>
<br>
Yesterday we deployed our IDPv3. All new VMs, so the cut-over was a
simple DNS change.<br>
Since we had the new environment up and running, we were able to
test everything except ECP using the hosts file trick.<br>
7am on Sunday happened, and everything was happy. <br>
We tested our ECP clients, Thunderbird, iPhone native, Android
native, etc., and they were happy too.<br>
While we had some O365 servers that didn't honor the 300s DNS TTL, I
was able to verify via logs that our testing was hitting the IDPv3
servers.<br>
By 9am, all the old servers were doing was metadata transfers, so we
cheered and went about our Sunday.<br>
<br>
About 6:30pm, the president calls the CIO saying he can't get email
on his iPhone.<br>
<br>
Troubleshooting results in the following:<br>
Logs do not show any errors and are actually showing successful
release to MicroSoft via ECP:<br>
<blockquote><tt>2016-11-13 19:23:30,615 - INFO
[Shibboleth-Audit.SSO:241] -
20161114T032330Z|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_639a0cd2-8808-4a25-a47c-cfb0ef976ce9|urn:federation:MicrosoftOnline|<a class="moz-txt-link-freetext" href="http://shibboleth.net/ns/profiles/saml2/sso/ecp|https://idp.calpoly.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:PAOS|_b7e64d804125">http://shibboleth.net/ns/profiles/saml2/sso/ecp|https://idp.calpoly.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:PAOS|_b7e64d804125</a><br>
c75c0b840a1a52157d25|dmalone|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|MicrosoftOnline:UserID,MicrosoftOnline:ImmutableID|AAhzZWNyZXQ2OSmDFz3SzupZqiMAq73hpdHndV93NlKUDRYME+NHAuNM2oXWmTAOblcDqwpCEMuWBeBpnnj4pQ1JSwYaiRTd7htrvzh1ZycJZi5oiziPWU8JfdvrmH/cHktq6R1nIBRAXTxAOi4=|_48b271d2302cf78f502c817cfe4a1598|</tt><br>
</blockquote>
Further testing showed that Thunderbird and other IMAP clients are
working without issue.<br>
The clients with problems were all setup using ActiveSync.<br>
<br>
Running the test at <a class="moz-txt-link-freetext" href="https://testconnectivity.microsoft.com/">https://testconnectivity.microsoft.com/</a> , showed
we were failing the Autodiscover and Exchange ActiveSync test.<br>
<br>
Knowing the first question we would ask is "did anything change?",
we made the decision to fallback to IDPv2. <br>
The servers were still up and running, so it was a simple DNS
change.<br>
<br>
Again it took some time for the O365 servers to update their DNS,
but slowly they did, and like magic, iPhones started working...<br>
<br>
Running the <a class="moz-txt-link-freetext" href="https://testconnectivity.microsoft.com/">https://testconnectivity.microsoft.com/</a> again and we
are now passing the Autodiscover test, showing successful connection
to autodiscover.calpoly.edu which is a CNAME to
autodiscover.outlook.com.<br>
<br>
This name leads us to:
<a class="moz-txt-link-freetext" href="https://autodiscover-s.outlook.com/Autodiscover/Autodiscover.xml">https://autodiscover-s.outlook.com/Autodiscover/Autodiscover.xml</a><br>
Which prompts for authentication that is verified against our IDP
via ECP.<br>
<br>
Everything I saw tells me it was just coincidental that things
started working when we rolled back.<br>
Now I need to convince management and MicroSoft.<br>
So, has anyone seen anything similar?<br>
<br>
Thanks,<br>
Dan<br>
<div class="moz-signature">-- <br>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<title></title>
Dan Malone<br>
<font color="#999999">Lead Identity Management Architect<br>
Information Technology Services<br>
California Polytechnic State University<br>
San Luis Obispo, California<br>
<br>
Direct 805-756-6326<br>
<a class="moz-txt-link-abbreviated" href="mailto:dmalone@calpoly.edu">dmalone@calpoly.edu</a></font><br>
</div>
</body>
</html>