<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Hi all</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Just following up on this issue to let you know how we solved this issue (note that this issue is
<b>not</b> specifically with Shibboleth IdP, but with many third-party IdPs which are used in a Azure AD federated domain and therefore may help others in the future here as many Educational orgs use Shibboleth + O365). Our on-prem directory is not a traditional
Active Directory domain (we use OpenLDAP) and so we chose not to use Azure AD Connect.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
I discovered that this is a known issue for federated users. The solution (among others!) was
<a href="https://support.microsoft.com/en-us/help/4025960/federated-users-in-azure-ad-are-forced-to-sign-in-frequently" title="https://support.microsoft.com/en-us/help/4025960/federated-users-in-azure-ad-are-forced-to-sign-in-frequently">
well burried in Microsoft's documentation</a>. Our setup means that we provisioned the users manually using Powershell, and as such we did not use Azure AD Connect and did not sync any LastPasswordChangeTimestamp field as no password is set for federated users
in Azure AD.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<div><br>
</div>
<div><br>
</div>
<div>The solution is to sync the LastPasswordChangeTimestamp attribute using Azure AD Connect or set it in Powershell as follows<br>
</div>
<div><br>
</div>
<div> $RefreshTokensValidFrom = Get-Date<br>
</div>
<div><br>
</div>
<div> Set-MsolUser -UserPrincipalName john@contoso.com -StsRefreshTokensValidFrom $RefreshTokensValidFrom<br>
</div>
<div><br>
</div>
<div>https://support.microsoft.com/en-us/help/4025960/federated-users-in-azure-ad-are-forced-to-sign-in-frequently<br>
</div>
<span></span><br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<b>Cause</b><br>
<div>Federated users who do not have the LastPasswordChangeTimestamp attribute synced are issued session cookies and refresh tokens that have a Max Age value of 12 hours. This means that the program can silently retrieve new tokens to keep the user’s session
alive only up to 12 hours. After that time, the users are returned to the original IdP to re-authenticate.<br>
</div>
<div><br>
</div>
<div>This occurs because Azure AD cannot determine when to revoke tokens that are related to an old credential (such as a password that has been changed). Therefore, Azure AD must check more frequently to make sure that the user and associated tokens are still
in good standing.<br>
</div>
<div><br>
</div>
<div>For more information about token lifetimes and how they are managed, see the following Microsoft Azure article:
<br>
</div>
<a href="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-configurable-token-lifetimes" title="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-configurable-token-lifetimes">Configurable token lifetimes in Azure
Active Directory (Public Preview)</a>"<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<span>Hopefully this might help someone else in the future. Again I know this is not specifically a Shibboleth issue but thought it might help someone, someday.</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<span>Regards,</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<span>Tim.</span></div>
<div>
<div id="Signature"></div>
</div>
<div id="appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Joseph Fischetti <Joseph.Fischetti@marist.edu><br>
<b>Sent:</b> Monday 9 March 2020 5:52 PM<br>
<b>To:</b> users@shibboleth.net <users@shibboleth.net><br>
<b>Subject:</b> RE: Shibboleth IdP + O365 Modern Authentication client issue</font>
<div> </div>
</div>
<div lang="EN-US">
<div class="x_WordSection1">
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">We’re having the same behavior, for a subset of our users.</span></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Outlook will display a “Needs Password” notification in the bottom and won’t receive any new emails. Users will click that notification and after being prompted to log in (to the
shib login page), it’ll fail to get them on. Checking the shibboleth logs shows a valid/successful login at the time of the outlook failure (read: It’s not a shibboleth problem).</span></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">In every case that I’ve seen: When it happens, if the user reboots their machine instead of entering their password, outlook reconnects without a prompt (like it should). In addition,
in every case that I’ve seen, when the user is being asked for their password, the status of their refresh token in Azure is still valid.</span></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">It’s not every user (and there’s nothing we can do from a office365 point of view). It’s not even like we can figure out what version of the client is experiencing the problem.
I’ve seen it with multiple builds of Office 2019 (and I have no recorded instances of a user with 2016 having the issue… though that’s not to say it doesn’t exist).</span></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Joe</span></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<div style="border:none; border-left:solid blue 1.5pt; padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Tim Murphy<br>
<b>Sent:</b> Monday, March 9, 2020 12:57 PM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Shibboleth IdP + O365 Modern Authentication client issue</span></p>
</div>
</div>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;background:#FF6700">
<b><span style="color:black">[EXTERNAL EMAIL]</span></b></p>
<div>
<div>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:black">Hi all</span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:black">Just wondering if anyone has seen this before. We have set our Office 365 domain to federated mode and configured it to use our Shibboleth as the Identity Provider. All works so far
and users have configured their clients with our IdP.</span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:black">However we are noticing about every 24 hours that users are being signed out of the mobile/desktop clients, and being asked to login again. Has anyone seen this behaviour when using
Shibboleth IdP and Office 365? Normally mobile/desktop clients should be persistent and shouldn't force a user out, but asking here just in case.</span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:black">We have set our Azure AD Org policy, conditional access policy etc all to extended sessions on mobile apps, tried disabling MFA etc but to no avail. It should be noted that our IdP
stores sessions for a max of 24 hours or if you change IP.</span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:black">Regards,</span></p>
</div>
<div>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:black">Tim.</span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>