<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">2 maj 2017 kl. 17:57 skrev Peter Schober <<a href="mailto:peter.schober@univie.ac.at" class="">peter.schober@univie.ac.at</a>>:</div><br class="Apple-interchange-newline"><div class=""><div class="">* Admin IFMSA-Sweden <<a href="mailto:admin@ifmsa.se" class="">admin@ifmsa.se</a>> [2017-05-02 17:29]:<br class=""><blockquote type="cite" class="">We have a portal for Dynamics 365 using multiple external identities<br class="">for sign-in, e.g. Shibboleth IdP and ADFS. More info regarding the<br class="">SP can be found here:<br class=""><a href="https://www.microsoft.com/en-us/dynamics/crm-setup-and-administration/set-authentication-identity-for-a-portal.aspx" class="">https://www.microsoft.com/en-us/dynamics/crm-setup-and-administration/set-authentication-identity-for-a-portal.aspx</a> <http<br class=""></blockquote><br class="">OK, so that's an application hosted (SaaS) by Microsoft "unifying the<br class="">capabilities of CRM business software and ERP systems".<br class="">And you're trying to connect SAML IDPs to that, presumably those of<br class="">academic institutions? Then the protected resource would have to be<br class="">able to act as a SAML 2.0 Service Provider. The page doesn't say<br class="">anything about SAML, and the screenshot in section "Manage external<br class="">accounts" only lists:<br class="">Facebook, Google, Windows Live™ ID, WS-Federation, Yahoo!<br class="">One or two tings here are protocols, the rest IDPs. None are about SAML?<br class=""></div></div></blockquote><div><br class=""></div><a href="https://www.microsoft.com/en-us/dynamics/crm-setup-and-administration/saml-2-0-provider-settings-for-portals.aspx" class="">https://www.microsoft.com/en-us/dynamics/crm-setup-and-administration/saml-2-0-provider-settings-for-portals.aspx</a></div><div><br class=""></div><div>Yes, we do have several working external logins already, both Shibboleth and ADFS.<br class=""><br class=""><blockquote type="cite" class=""><div class=""><div class=""><blockquote type="cite" class="">We have not found this portal to be capable to consume Shibboleth<br class="">IdP Federation with IdP Discovery Service which requires signing of<br class="">keys and certificates. Even though we are still trying to find ways<br class="">to connect through Shibboleth IdP Discovery Service (i.e. Proxy<br class="">IdP), we look at same time other ways to achieve almost the same<br class="">result<br class=""></blockquote><br class="">Are you saying you're able to hook up individual SAML 2.0 IDPs<br class="">(possibly of the Shibboleth implementation, but that's really<br class="">irrelevant here) to that resource and use them for externalized<br class="">authentication and authorization? And that the product does not allow<br class="">consuming definitions of SAML 2.0 IDPs in machine-readable format<br class="">(i.e., via SAML 2.0 Metadata)? Or that you can define many SAML IDPs<br class="">in the product but that you have no way to select a specific IDP?<br class=""></div></div></blockquote><div><br class=""></div><div>We can add one IdP at a time. However we might end up with adding so many IdPs that we don’t have resources to handle individually. I think the problem arises with generation of persistent name ID which is not yet default for many IdPs, we could add IdPs individually and ask for persistent id, however, it would be nice to get it from federated metadata, that is to save time for us all. Anyways, the portal doesn’t have it’s own metadata with keys and we can’t sign federation metadata anywhere.</div><div><br class=""></div><div>Proxy IdP is really not an ideal solution or situation we as a small organization with limited resources want to be in. Since Azure AD has a couple of options, I am trying to find ways to use it, or we have to have our own Proxy IdP, else we will add individual IdPs one by one (which I guess will require more maintenance).</div><div><br class=""></div><div>Thanks</div><div><br class=""></div><div>Mats</div><br class=""><blockquote type="cite" class=""><div class=""><div class="">Totally guessing based solely on some of the words you used.<br class="">-peter<br class="">-- <br class="">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a></div></div></blockquote></div><br class=""></body></html>