<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>Talk to your Microsoft rep and ask for a test tennant. Call EDUCAUSE and setup a similar domain name to yours for it (eg: we are csuohio.edu in prod /// clevelandstate.edu for dev)</p>
<p><br>
</p>
<p>Add a domain controller to your forest, then remove it, then change the UPN to something like bloomuniversity.edu and do the customary ad-sync, adfs, etc. The how-to on this is easy to find.</p>
<p><br>
</p>
<p>We have 110k users in prod and 110k in test. Test costs nothing. They still honor your production support contract for test stuff.</p>
<p><br>
</p>
<p>I'm all for "move fast and break things" and "nope, we didn't .. did you try rebooting?" .. but I would not screw with SAML in a prod Azure tenant without having tested it .. twice.</p>
<p><br>
</p>
<p>But yes, your commands are right. I have a write-up on it from a year(ish) back that does step-by-step.</p>
<p><br>
</p>
<p>The gotchas:</p>
<p><br>
</p>
<p>The cert can't have newlines in it. Meaning cut/paste line by line into notepad to be safe.</p>
<p>The ECP is tricky to get working. It expects to return sourceAnchor which is a bin->base64 of the GUID, IIRC .. Shib does this natively but it's not well documented. I can give you the config snips if you want from a fairly basic setup.</p>
<p><br>
</p>
<p>Free advice? .. if you are buying O365 on an educational (E3?) schedule you probaby get free Azure credits ... just throw a pair of samba/openldap boxen up in there along with your cas/adfs/shib/whatever and load-balance it. It'll cost you like $100/mo and
you don't have to deal with outages. You can use their NLB as long as you're willing to do a NS2 -> azure. You can do mix of on/off prem too, the GLSB/NLB has all softs of fancy probes. IDK what your contract has but we get something like $6k per quarter in
Azure IaaS money. Bonus? : it's pre-configured to work with ADAL (yes, even Cas/Shib) so you can dole it out to students/compSci/devOps/whatever and the billing API you can suck right into Excel.</p>
<p><br>
</p>
<p>Also, and I realize this is sacrilege here .. but have you considered using CAS instead? .. O365 is native and so is Shib fed. Plus you get OAUTH, PAC4J, and other goodies.</p>
<p><br>
</p>
<p>Hit me off-list (you or anyone else) for more on any of this ...</p>
<p><br>
</p>
<p>Cheers,</p>
<p><br>
</p>
<p>Michael Holstein CISSP</p>
<p>Mgr. Network & Data Security</p>
<p>Cleveland State University</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Kozlek, Vincent <vkozlek@bloomu.edu><br>
<b>Sent:</b> Monday, November 6, 2017 2:15:59 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> RE: conversion from ADFS to Shibboleth for Office 365 ?</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif}
a:x_link, span.x_MsoHyperlink
{color:#0563C1;
text-decoration:underline}
a:x_visited, span.x_MsoHyperlinkFollowed
{color:#954F72;
text-decoration:underline}
p.x_msonormal0, li.x_msonormal0, div.x_msonormal0
{margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif}
span.x_EmailStyle18
{font-family:"Calibri",sans-serif;
color:windowtext}
span.x_EmailStyle19
{font-family:"Calibri",sans-serif;
color:#1F497D}
.x_MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.x_WordSection1
{}
-->
</style>
<div lang="EN-US" link="#0563C1" vlink="#954F72" style="background-color:white">
<div class="x_WordSection1">
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">No guarantee this will still work, but in the past (2013-2016) when I’ve had to make any changes to the federation config of an office365 domain, I typically had to temporarily change the
domain auth back to office365 managed, then back to federated with the new settings. The user auth outage in my experience is very short, but still nerve-racking. I never had a problem in the past doing this and in fact it was the only way to effectively
change federation config (i.e. even just changing the entityId or a URL). Changing back to Office365 managed auth clears out all of the federation configuration in my experience, and then when you change back to federation, all the new values take effect.</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">Commands/timing from my notes…</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">Set-MSOLDomainAuthentication -Authentication Managed -DomainName office365.domainname.edu</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D"><wait some time, typically just a couple minutes – actually hit the office365 login page (i.e. portal.office.com or outlook.com/office365.domainname.edu) and enter a [valid or fake] username
in your domain, such as <a href="mailto:a@office365.domainname.edu">a@office365.domainname.edu</a> to make sure office365 stops redirecting to a federated login page before running the next step></span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">Set the variables equal to the desired configuration… i.e.</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">$dom = “office365.domainname.edu”</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">$url = “https://sso.domainname.edu/idp/profile/SAML2/POST/SSO”</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">$ecpUrl = “https://sso.domainname.edu/idp/profile/SAML2/SOAP/ECP”</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">$uri = “https://sso.domainname.edu/idp/shibboleth”</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">$logouturl = “https://sso.domainname.edu/idp/profile/Logout”</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">$cert = “<actual cert>”</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">Set-MsolDomainAuthentication -DomainName $dom -FederationBrandName $dom -Authentication Federated -PassiveLogOnUri $url -SigningCertificate $cert -IssuerUri $uri -ActiveLogOnUri $ecpUrl -LogOffUri
$logouturl -PreferredAuthenticationProtocol SAMLP</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">Not sure if any of those cmdlets have changed in the past year. I last performed these steps on 10/5/16 and it always worked flawlessly to get federation values to successfully change and
take effect.</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">If it’s not clear, while the domain is set to managed authentication, your users will be unable to authenticate. For me it was such a short outage that I don’t even notify users and instead
just perform the change at a low-usage time.</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">It is important to wait until the first command takes effect. If you try setting it back to federation prematurely, it may not take effect correctly and you’ll have to set it back to Managed
and wait for that to take effect prior to changing back to Federation a second time.</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D">Good luck. It’s amazing to me that Microsoft support is unable to instruct you on a method to handle this. I guess I had to figure out my method on my own back in 2013. I hope it still
works for you. You could always run it by support to see what they think.</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:#1F497D"> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal"><b><span style="font-size:11.0pt">From:</span></b><span style="font-size:11.0pt"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Robert Rust<br>
<b>Sent:</b> Monday, November 6, 2017 11:58 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> conversion from ADFS to Shibboleth for Office 365 ?</span></p>
</div>
</div>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal"><span style="font-size:11.0pt">Has anybody on the list moved from ADFS to Shibboleth authentication for Office 365? I’m running into some headaches with one of the Office 365 federation attributes, specifically the MetadataExchangeURI.
All the docs and examples I’ve found indicate it should be left blank for Shibboleth, but I’m not finding a way to clear the value. Working with MS, I managed to get it changed to a new value (that doesn’t work), but I haven’t been able to clear it. So,
I’m looking to see if anybody else has made this move and encountered similar issues.</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt">-Robert</span></p>
<p class="x_MsoNormal"><span style="font-size:10.5pt; color:black">-- </span></p>
<div>
<p class="x_MsoNormal"><span style="font-size:10.5pt; color:black">~~~~~~~~~~~~~~~~~~~~~~~~~</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:10.5pt; color:black">Robert J. Rust</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:10.5pt; color:black">Systems Administrator</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:10.5pt; color:black">Division of Technology Services</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:10.5pt; color:black">Univ. of Wisc. - River Falls</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:10.5pt; color:black">~~~~~~~~~~~~~~~~~~~~~~~~~</span></p>
</div>
<div>
<p class="x_MsoNormal" style=""><span style="font-size:10.5pt; color:black"><img border="0" width="282" height="46" id="x__x0000_i1025" alt="ps://www2.uwrf.edu/static/images/email-wordmark.png" style="width:2.9375in; height:.4791in" src="https://www2.uwrf.edu/static/images/email-wordmark.png"></span></p>
<p class="x_MsoNormal" style=""><b><u><span style="font-size:10.5pt; color:black">******* BE ALERT *******</span></u></b><span style="font-size:10.5pt; color:black"></span></p>
<p class="x_MsoNormal" style=""><span style="font-size:10.5pt; color:black">Technology Services will never ask you for your password, personal information, or to verify your account via e-mail.</span></p>
</div>
<p class="x_MsoNormal"><span style="font-size:10.5pt; color:black">If you receive a request for your password or personal information, delete immediately and do not reply.
</span></p>
</div>
</div>
</body>
</html>