<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">No guarantee this will still work, but in the past (2013-2016) when I’ve had to make any changes to the federation config of an office365 domain, I typically had to temporarily change the domain
auth back to office365 managed, then back to federated with the new settings. The user auth outage in my experience is very short, but still nerve-racking. I never had a problem in the past doing this and in fact it was the only way to effectively change
federation config (i.e. even just changing the entityId or a URL). Changing back to Office365 managed auth clears out all of the federation configuration in my experience, and then when you change back to federation, all the new values take effect.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Commands/timing from my notes…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Set-MSOLDomainAuthentication -Authentication Managed -DomainName office365.domainname.edu<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><wait some time, typically just a couple minutes – actually hit the office365 login page (i.e. portal.office.com or outlook.com/office365.domainname.edu) and enter a [valid or fake] username
in your domain, such as <a href="mailto:a@office365.domainname.edu">a@office365.domainname.edu</a> to make sure office365 stops redirecting to a federated login page before running the next step><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Set the variables equal to the desired configuration… i.e.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">$dom = “office365.domainname.edu”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">$url = “https://sso.domainname.edu/idp/profile/SAML2/POST/SSO”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">$ecpUrl = “https://sso.domainname.edu/idp/profile/SAML2/SOAP/ECP”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">$uri = “https://sso.domainname.edu/idp/shibboleth”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">$logouturl = “https://sso.domainname.edu/idp/profile/Logout”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">$cert = “<actual cert>”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Set-MsolDomainAuthentication -DomainName $dom -FederationBrandName $dom -Authentication Federated -PassiveLogOnUri $url -SigningCertificate $cert -IssuerUri $uri -ActiveLogOnUri $ecpUrl -LogOffUri
$logouturl -PreferredAuthenticationProtocol SAMLP<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Not sure if any of those cmdlets have changed in the past year. I last performed these steps on 10/5/16 and it always worked flawlessly to get federation values to successfully change and take
effect.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">If it’s not clear, while the domain is set to managed authentication, your users will be unable to authenticate. For me it was such a short outage that I don’t even notify users and instead
just perform the change at a low-usage time.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">It is important to wait until the first command takes effect. If you try setting it back to federation prematurely, it may not take effect correctly and you’ll have to set it back to Managed
and wait for that to take effect prior to changing back to Federation a second time.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Good luck. It’s amazing to me that Microsoft support is unable to instruct you on a method to handle this. I guess I had to figure out my method on my own back in 2013. I hope it still works
for you. You could always run it by support to see what they think.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt">From:</span></b><span style="font-size:11.0pt"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Robert Rust<br>
<b>Sent:</b> Monday, November 6, 2017 11:58 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> conversion from ADFS to Shibboleth for Office 365 ?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Has anybody on the list moved from ADFS to Shibboleth authentication for Office 365? I’m running into some headaches with one of the Office 365 federation attributes, specifically the MetadataExchangeURI.
All the docs and examples I’ve found indicate it should be left blank for Shibboleth, but I’m not finding a way to clear the value. Working with MS, I managed to get it changed to a new value (that doesn’t work), but I haven’t been able to clear it. So,
I’m looking to see if anybody else has made this move and encountered similar issues.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">-Robert<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">-- <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">~~~~~~~~~~~~~~~~~~~~~~~~~<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Robert J. Rust<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Systems Administrator<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Division of Technology Services<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Univ. of Wisc. - River Falls<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">~~~~~~~~~~~~~~~~~~~~~~~~~<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;color:black"><img border="0" width="282" height="46" style="width:2.9375in;height:.4791in" id="_x0000_i1025" src="https://www2.uwrf.edu/static/images/email-wordmark.png" alt="ps://www2.uwrf.edu/static/images/email-wordmark.png"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><u><span style="font-size:10.5pt;color:black">******* BE ALERT *******</span></u></b><span style="font-size:10.5pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.5pt;color:black">Technology Services will never ask you for your password, personal information, or to verify your account via e-mail.<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">If you receive a request for your password or personal information, delete immediately and do not reply.
</span><o:p></o:p></p>
</div>
</body>
</html>