<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:11pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Clarification: You'll want to look here <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPShibbolethXML" class="OWAAutoLink" id="LPlnk108862" previewremoved="true">
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPShibbolethXML</a> in particular, once again, assuming that your organization uses Azure AD as an Identity Provider, and you just want to protect an application using the Shibboleth Service Provider.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">The quick summary (documentation covers all of this) is that you need to:</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">1) Configure your web server software to work with the Shibboleth SP (<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPIISConfig" class="OWAAutoLink" id="LPlnk213311" previewremoved="true">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPIISConfig</a>
or <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig" class="OWAAutoLink" id="LPlnk172714" previewremoved="true">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig</a>)<br>
</p>
<p style="margin-top:0;margin-bottom:0">2) Make the Shibboleth SP aware of your Azure AD IdP by loading its metadata (<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataProvider" class="OWAAutoLink" id="LPlnk163180" previewremoved="true">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataProvider</a>)</p>
<p style="margin-top:0;margin-bottom:0">3) Map incoming requests to protect URLs that you care about (<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapper" class="OWAAutoLink" id="LPlnk32267" previewremoved="true">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapper</a>)</p>
<p style="margin-top:0;margin-bottom:0">4) Configure the Shibboleth SP to extract attributes (claims, in ADFS-speak) and pass them to your application (<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtractor" class="OWAAutoLink" id="LPlnk552902" previewremoved="true">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtractor</a>
and <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute" class="OWAAutoLink" id="LPlnk663570" previewremoved="true">
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute</a>)</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Once again, this isn't a comprehensive list of what you'll need to do, but I'm hopeful it'll serve as a good starting point. To date, the Shibboleth SP is still on version 2.X, so if you're looking at version 3.X configuration,
you're either looking at the IdP documentation pages (which won't help at all) or pre-release Shibboleth SP 3.X documentation (also not what you want).<br>
</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Michael<br>
<br>
</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Domingues, Michael D <michael-domingues@uiowa.edu><br>
<b>Sent:</b> Monday, June 4, 2018 6:58:01 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Re: How to add relying party (Azure AD (AFDS)) to Shib IdP V3</font>
<div> </div>
</div>
<meta content="text/html; charset=us-ascii">
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:11pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p style="margin-top:0; margin-bottom:0">Hi Jesper,</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">It appears that you're mixing up the IdP and the SP software. In this instance, because you want to use Azure AD as your Identity Provider, you don't need to run the Shibboleth IdP software on your web server, just the
Shibboleth SP component.</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">The configuration you pasted below (from relying-party.xml) is for the IdP not the SP, so of course it's not having any effect on the SP configuration.</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">Documentation on SP configuration can be found here:
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfiguration" class="x_OWAAutoLink" id="LPlnk933680">
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfiguration</a></p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">Best,</p>
<p style="margin-top:0; margin-bottom:0">Michael<br>
<br>
</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Jesper <jesper.laursen@lego.com><br>
<b>Sent:</b> Monday, June 4, 2018 2:50:27 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> How to add relying party (Azure AD (AFDS)) to Shib IdP V3</font>
<div> </div>
</div>
<div class="x_BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="x_PlainText">Hi <br>
<br>
I would like to know if some one has one example for Shib Idp V3 how to<br>
configure it to login via Azue AD (AFDS) <br>
<br>
I have end-point definitions from Azure: <br>
o SAML Single Sign-On Service URL:<br>
<a href="https://login.microsoftonline.com/1d063515.../saml2">https://login.microsoftonline.com/1d063515.../saml2</a><br>
o SAML Entity ID: <a href="https://sts.windows.net/1d063515.../">https://sts.windows.net/1d063515.../</a><br>
o Sign-Out URL:<br>
<a href="https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0">https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0</a><br>
o SAML Signing Certificate - Base64 encoded o SAML Signing Certificate - Raw<br>
o SAML XML Metadata <br>
<br>
<br>
And I have my on premise Web server running Shibboleth SP + IdP 3 on IIS /<br>
Jetty. <br>
The /secure is kicking the scenario of: <a href="https://localserver.corp.com/secure">
https://localserver.corp.com/secure</a><br>
<br>
But it doesn't use the relying-party stuff: <br>
<br>
<bean parent="RelyingPartyByName"<br>
c:relyingPartyIds="urn:federation:MicrosoftOnline"> <br>
<property name="profileConfigurations"> <br>
<list> <br>
<bean parent="SAML2.SSO"<br>
p:encryptAssertions="false" /> <br>
</list> <br>
</property><br>
</bean> <br>
<br>
I have tried everything - but the above is the ones which doesn't make it<br>
fail. It simply doesn't call Azure. <br>
So I must be missing some keyword to trigger the Relying party that it<br>
should be used for my: /secure path <br>
<br>
I simply don't know where to find the proper configuration. For a newbee it<br>
is hard to understand if it is V2 or V3 syntax. So that's why I'm hoping<br>
that someone could actually share the steps to get authenticated in AFDS<br>
(Azure AD) from a IIS with Shibboleth installed. <br>
Thanks a lot... <br>
This is killing me - slowly... <br>
<br>
<br>
<br>
<br>
--<br>
Sent from: <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html">
http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html</a><br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</div>
</body>
</html>