<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal">We are going through an issue with our new ADFS 2016 upgrade and current environment Shibboleth 2.4.4<o:p></o:p></p>
<p class="MsoNormal">I will describe our current ADFS 2.0 and Shibboleth 2.4.4<o:p></o:p></p>
<p class="MsoNormal">WE have a load balancer that is fronting ADFS. In the LB we have an iRule that appends the cookie MSIPIPSelectionPersistent with a value in the HTTP header.<o:p></o:p></p>
<p class="MsoNormal">That value is based on where the user is coming from. <br>
We have it set up such that:<br>
<br>
If the user is coming from an smartphone app (active – outlook/exchange app)<br>
append cookie value with the ADFS url to authenticate (example: MSIPIPSelectionCookie=”https://adfs.miami.edu”)<br>
<br>
if the user is coming from a web browser (passive)<br>
append cookie value with the Shibboleth URL to authenticate (example: MSIPIPSelectionCookie=<a href="https://shibboleth.miami.edu">https://shibboleth.miami.edu</a>)<br>
<br>
<o:p></o:p></p>
<p class="MsoNormal">This cookie is supposed to help avoiding showing the ADFS screen for the user to choose how they want to authenticate (in a drop down that shows Active Directory and Shibboleth instance).<o:p></o:p></p>
<p class="MsoNormal">This works perfectly fine in our ADFS 2.0 and Shibboleth 2.4.4.<o:p></o:p></p>
<p class="MsoNormal">However, we are in the process of upgrading from ADFS 2.0 to ADFS 2016.
<br>
in our test environment, the iRule does not work with the active connections (Smarphones outlook/exchange app for email) but it works fine with a browser (passive). It does not show the drop down to choose and just redirects our Test email web based outlook
to our Shibboleth login page.<br>
However, the app for outlook when adding a new account, gives an error in ADFS. <br>
<br>
Can someone out there have done ADFS 2016 with Shibboleth interoperability before?<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt">By the way, these are the iRule:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt">when HTTP_REQUEST {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> if {[string tolower [HTTP::query]] contains "wauth=http://schemas.microsoft.com/ws/"} {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> # Set the value we will use for the MSISIPSelectionPersistent cookie to<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> # the Base64 encoded ADFS entityID we want the user to authenticate with.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> # The entityID that encodes is "http://adfs.miami.edu'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> set cookieValue "ijusoiadfjioasdklfjaslkdf"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> } else {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> # Set the value we will use for the MSISIPSelectionPersistent cookie to<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> # the Base64 encoded IdP entityID we want the user to authenticate with.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> # The entityID that encodes is "https://shibboleth.miami.edu'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> set cookieValue "asdfdasfsadfsadfadfsdf"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> if {[HTTP::header exists Cookie]} {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> set cookie [HTTP::header value Cookie]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> append cookie "; MSISIPSelectionPersistent=$cookieValue"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> HTTP::header remove Cookie<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> HTTP::header insert Cookie $cookie<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> log local0. "Cookie: $cookie"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> } else {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> set cookie [HTTP::header value Cookie]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> append cookie "MSISIPSelectionPersistent=$cookieValue"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> HTTP::header remove Cookie<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> HTTP::header insert Cookie $cookie<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> log local0. "Cookie: $cookie"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt">}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:black">Thank you,<b><o:p></o:p></b></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">Dyana Alvarez,</span></b><b><span style="color:black"> M.Sc.</span></b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><br>
Sr. Programmer<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">P: (305) 284-3521<o:p></o:p></span></p>
<p class="MsoNormal"><img border="0" width="219" height="55" id="Picture_x0020_1" src="cid:image001.png@01D362B2.650C9320"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>