<div dir="ltr"><div dir="ltr"><div dir="ltr">Hi All<div>I am going to try above solution shortly (inline script), but just to clarify few things before I try, Given we already got offce365 working for students I will only register the Staff domain end points with additional param</div><div>e.g</div><div>$url =<br>"<a href="https://idp.contoso.com/idp/profile/SAML2/POST/SSO?morid=constoso.de" rel="noreferrer" target="_blank">https://idp.contoso.com/idp/profile/SAML2/POST/SSO?morid=constoso.de</a>"<br>$ecpUrl =<br>"<a href="https://idp.contoso.com/idp/profile/SAML2/SOAP/ECP?morid=contoso.de" rel="noreferrer" target="_blank">https://idp.contoso.com/idp/profile/SAML2/SOAP/ECP?morid=contoso.de</a>"<br>$uri = "<a href="https://idp.contoso.com/idp/shibboleth/contoso.de" rel="noreferrer" target="_blank">https://idp.contoso.com/idp/shibboleth/contoso.de</a>"<br></div><div><br></div><div>And I believe things will work as we got the default responderID in the script.<br></div><div><br></div><div>Main other thing I want to clarify for the sake of completeness is currently we got a override as below in relyingparty.xml</div><div><br></div><div><div> <bean parent="RelyingPartyByName" c:relyingPartyIds="urn:federation:MicrosoftOnline"></div><div> <property name="profileConfigurations"></div><div> <list></div><div> <bean parent="SAML2.SSO" p:encryptAssertions="false" p:signAssertions="true" p:signResponses="false" p:encryptNameIDs="false" p:authenticationFlows="#{{'Shibcas'}}" /></div><div> <bean parent="SAML2.ECP" p:encryptAssertions="false" p:signAssertions="true" p:signResponses="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" p:authenticationFlows="#{{'Password'}}" /></div><div> </list></div><div> </property></div><div> </bean></div></div><div><br></div><div><br></div><div>and then we use p:postAuthenticationFlowsLookupStrategy-ref="microsoftOnlineResponderIdScript" as stated below in the overides ? please confirm</div><div><br></div><div>e.g. </div><div><br></div><div>.....</div><div>.....</div><div><br></div><div><div><bean parent="SAML2.SSO" p:encryptAssertions="false" p:signAssertions="true" p:signResponses="false" p:encryptNameIDs="false" p:authenticationFlows="#{{'Shibcas'}}" p:postAuthenticationFlowsLookupStrategy-ref="microsoftOnlineResponderIdScript" /></div><div><br></div><div> <bean parent="SAML2.ECP" p:encryptAssertions="false" p:signAssertions="true" p:signResponses="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" p:authenticationFlows="#{{'Password'}}" p:postAuthenticationFlowsLookupStrategy-ref="microsoftOnlineResponderIdScript" /></div></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Oct 14, 2017 at 6:44 AM Adam Crump <<a href="mailto:Adam.Crump@amkor.com">Adam.Crump@amkor.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Opps, you are correct here is the complete script<br>
--> <util:map id="microsoftOnlineRespondersIdMap"><br>
<entry key="default" value="<a href="https://idp.contoso.com/idp/shibboleth/contoso" rel="noreferrer" target="_blank">https://idp.contoso.com/idp/shibboleth/contoso</a> /><br>
<entry key="contoso " value=" <a href="https://idp.contoso.com/idp/shibboleth/contoso.de" rel="noreferrer" target="_blank">https://idp.contoso.com/idp/shibboleth/contoso.de</a>" /><br>
</util:map><br>
<!-- Custome object for the inline script --><br>
<util:map id="customObjectsMicrosoftOnlineResponderIdScript"><br>
<entry key="httpServletRequest" value-ref="shibboleth.HttpServletRequest" /><br>
<entry key="microsoftOnlineRespondersIdMap" value-ref="microsoftOnlineRespondersIdMap" /><br>
</util:map><br>
<!-- responder script. Look for a url parambeter of morid and check to see if the issuerID should be changed --><br>
<bean id="microsoftOnlineResponderIdScript" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"<br>
p:customObject-ref="customObjectsMicrosoftOnlineResponderIdScript"><br>
<constructor-arg><br>
<value><br>
<![CDATA[<br>
//by default we always return the default responderId<br>
responderId = custom.get('microsoftOnlineRespondersIdMap').get('default');<br>
//check to the existence of the key from the URL to switch the responder<br>
requestedResponder = custom.httpServletRequest.getParameter('morid');<br>
if (custom.microsoftOnlineRespondersIdMap.containsKey(requestedResponder)){<br>
responderId = custom.microsoftOnlineRespondersIdMap.get(requestedResponder);<br>
}<br>
responderId;<br>
]]> <br>
</value><br>
</constructor-arg><br>
</bean><br>
<br>
<br>
On 10/13/17, 2:26 AM, "users on behalf of Peter Schober" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>> wrote:<br>
<br>
* <a href="mailto:adam.crump@amkor.com" target="_blank">adam.crump@amkor.com</a> <<a href="mailto:adam.crump@amkor.com" target="_blank">adam.crump@amkor.com</a>> [2017-10-13 00:51]:<br>
> I have just stumbled upon this issue myself. I would like to offer this<br>
> alternative responderStrategy that can be managed completely in the<br>
> relying-party.xml using an inline script.<br>
[...]<br>
> <bean id="microsoftOnlineResponderIdScript"<br>
> parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"<br>
> p:customObject-ref="customObjectsMicrosoftOnlineResponderIdScript"><br>
> <constructor-arg><br>
> <value><br>
> <br>
> </value><br>
> </constructor-arg><br>
> </bean><br>
<br>
Seems to me there's missing something, e.g. the actual script?<br>
-peter<br>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
<br>
<br>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>