<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Many thanks to all for your responses. All of these docs have helped to complete the picture. The Shibboleth wiki integration guide looks like an excellent resource.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Thanks,</p>
<p style="margin-top:0;margin-bottom:0">Paul</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Greg Haverkamp <gahaverkamp@lbl.gov><br>
<b>Sent:</b> Thursday, March 22, 2018 11:19:22 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Office 365 Shibboleth SAML 2.0 SSO with LDAP backend</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div class="x_gmail_extra">
<div class="x_gmail_quote">On Thu, Mar 22, 2018 at 8:54 AM, Hohberg, Paul <span dir="ltr">
<<a href="mailto:phohberg@it.ucla.edu" target="_blank">phohberg@it.ucla.edu</a>></span> wrote:<br>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div id="x_gmail-m_3224159615805016333divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif">
<p style="margin-top:0px; margin-bottom:0px">Has anyone successfully implemented Office 365 Shibboleth SSO using SAML 2.0 (not just ECP) with an LDAP (not AD) authentication backend? Would you be willing to share how it was done, even if at a high level or
point me to any related documentation?</p>
<p style="margin-top:0px; margin-bottom:0px"><br>
</p>
<p style="margin-top:0px; margin-bottom:0px">It seems that Office 365 requires an immutableID attribute that is mapped to GUID when AD is used for authentication. We're considering if this can be mapped to an attribute in LDAP that Office 365 would accept.</p>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Yes. They don't care.</div>
<div><br>
</div>
<div>We basically followed this: <a href="https://wiki.shibboleth.net/confluence/x/BoFKAQ">https://wiki.shibboleth.net/confluence/x/BoFKAQ</a></div>
<div><br>
</div>
<div>And used a different local, unique attribute. We also followed the MS documentation that Carl linked to. (Our Office365 admin was apparently incapable of doing so, despite our repeated requests that he stop contacting MS support and just do what we were
telling him to do.)</div>
<div><br>
</div>
<div>Greg</div>
<div> </div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div id="x_gmail-m_3224159615805016333divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif">
<p style="margin-top:0px; margin-bottom:0px"><br>
</p>
<p style="margin-top:0px; margin-bottom:0px">Microsoft documentation provides this attribute-resolver example for immutableID and GUID with AD.</p>
<pre style="padding:5px; margin-top:0px; margin-bottom:0px; overflow:auto; word-wrap:normal; font-size:13px; font-family:Consolas,Courier,monospace"><!-- Use AD objectGUID for ImmutableID -->
<resolver:AttributeDefinition id="ImmutableID" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.<wbr>0:resolver:ad"
sourceAttributeID="objectGUID"<wbr>>
<resolver:Dependency ref="myLDAP" /></pre>
<pre style="padding:5px; margin-top:0px; margin-bottom:0px; overflow:auto; word-wrap:normal; font-size:13px; font-family:Consolas,Courier,monospace"><span style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><a href="https://technet.microsoft.com/en-us/library/jj205463" class="x_gmail-m_3224159615805016333OWAAutoLink" id="x_gmail-m_3224159615805016333LPlnk385692" target="_blank">https://technet.microsoft.com/<wbr>en-us/library/jj205463</a></span><br></pre>
<pre style="padding:5px; margin-top:0px; margin-bottom:0px; overflow:auto; word-wrap:normal; font-size:13px; font-family:Consolas,Courier,monospace"><br></pre>
<pre style="padding:5px; margin-top:0px; margin-bottom:0px; overflow:auto; word-wrap:normal; font-size:13px; font-family:Consolas,Courier,monospace"><span style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt">Thanks in advance,</span></pre>
<pre style="padding:5px; margin-top:0px; margin-bottom:0px; overflow:auto; word-wrap:normal; font-size:13px; font-family:Consolas,Courier,monospace"><div style="white-space:normal; color:rgb(33,33,33); font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont; font-size:15px; margin:0px"><font face="Times New Roman" size="3"><span style="font-size:12pt"><font face="Calibri" size="2" color="black"><span style="font-size:10.5pt"><b><span style="font-size:12pt">Paul Hohberg</span></b></span></font></span></font></div><div style="white-space:normal; color:rgb(33,33,33); font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont; font-size:15px"><div style="margin:0px"><font face="Times New Roman" size="3"><span style="font-size:12pt"><font face="Calibri" size="2" color="black"><span style="font-size:10.5pt"><i><span style="font-size:11pt">Systems Engineer</span></i></span></font></span></font></div></div><div style="white-space:normal; color:rgb(33,33,33); font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif,serif,EmojiFont; font-size:15px"><div style="margin:0px"><font face="Times New Roman" size="3"><span style="font-size:12pt"><font face="Calibri" size="2" color="black"><span style="font-size:10.5pt"><i><span style="font-size:11pt">UCLA Information Management Services</span></i></span></font></span></font></div></div></pre>
</div>
</div>
<br>
--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">
https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.<wbr>net</a><br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</body>
</html>