<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Helvetica 75 Bold";
panose-1:2 11 8 4 2 2 2 2 2 4;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
p.msipfootered91ed98, li.msipfootered91ed98, div.msipfootered91ed98
{mso-style-name:msipfootered91ed98;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Arial",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1455100244;
mso-list-template-ids:-868345128;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1
{mso-list-id:1594195422;
mso-list-type:hybrid;
mso-list-template-ids:-480361728 67895297 67895299 67895301 67895297 67895299 67895301 67895297 67895299 67895301;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FR" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Version Francaise<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">------------------<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Bonjour</span><span style="font-family:"Cambria",serif;mso-fareast-language:FR">
<span style="color:#1F497D">la communauté, <o:p></o:p></span></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Nous avons déployé un shibboleth SP sur un serveur windows 2019 avec IIS 8.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Nous avons configuré une authentification saml avec un fourniseur (idp) d’identié tier.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">L’authentification fonctionne bien, nous récupérons bien les informations suivantes dans une session shibboleth:<o:p></o:p></span></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoListParagraph" style="color:#1F497D;margin-left:0cm;mso-list:l1 level1 lfo3">
<span style="font-family:"Cambria",serif;mso-fareast-language:FR">Adresse mail<o:p></o:p></span></li><li class="MsoListParagraph" style="color:#1F497D;margin-left:0cm;mso-list:l1 level1 lfo3">
<span style="font-family:"Cambria",serif;mso-fareast-language:FR">Nom prénom<o:p></o:p></span></li><li class="MsoListParagraph" style="color:#1F497D;margin-left:0cm;mso-list:l1 level1 lfo3">
<span style="font-family:"Cambria",serif;mso-fareast-language:FR">samaccountname <o:p>
</o:p></span></li></ul>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Le serveur Web IIS expose un serveur de fichier avec des droits (partage ntfs).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Nous avons un dossier par utilisateur et seul l’utilisateur (propriétaire du dossier) peut y accéder.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Nous avons créé un virtual folder IIS pour accéder à ces dossiers (dossier accéssible que par l’utilisateur courant).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Les utilisateurs peuvent accéder a leur dossier en lecture seule avec le mode d’authtenfication IIS windows http 401 challenge.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Nous souhaitons désactiver ce mode au profit du saml, IIS recoit bien le samaccountname (visible dans les logs d’accés IIS),cependant l’authenification ne semble
pas se propager au niveau windows.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Quelle serait la configuration necessaire pour faire en sorte que l’utilisateur authentifié par shibboleht le soit aussi au niveau windows au moment d’accéder
au virtual folder et à son dossier ? <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Merci par avance pour votre aide,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">English version<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">---------------------<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Dear community,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">We deployed a shibboleth SP on a windows 2019 server with IIS 8.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">We have configured a saml authentication with a third party identity provider (idp).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">The authentication is working fine, we are getting the following information in a shibbolethsession:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">- Email address<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">- First name<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">- samaccountname<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">The IIS web server exposes a file server with rights (ntfs share).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">We have one folder per user and only the user (owner of the folder) can access it.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">We have created a virtual IIS folder to access these folders (folder accessible only by the current user).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Users can access their folder in read-only mode with the IIS windows http 401 challenge authentication mode.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">We will disable this mode in favor of saml, IIS receives the samaccountname (visible in the IIS access logs), however the authentication does not
seem to propagate to the windows level.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">What would be the configuration needed to make the user authenticated by shibboleht also be at windows level when accessing the virtual folder
and its folder?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR">Thanks in advance for your help,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Cambria",serif;color:#1F497D;mso-fareast-language:FR"><img width="94" height="40" style="width:.9833in;height:.4166in" id="Image_x0020_1" src="cid:image001.gif@01D94AA6.113542B0"></span><span lang="EN-US" style="color:#1F497D;mso-fareast-language:FR"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D;mso-fareast-language:FR">Ody Sébastien
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D;mso-fareast-language:FR">Business&Décision OBS<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="msipfootered91ed98" align="center" style="margin:0cm;text-align:center">
<span style="font-size:8.0pt;font-family:"Helvetica 75 Bold",sans-serif;color:#ED7D31">Orange Restricted</span><o:p></o:p></p>
</div>
<PRE>_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</PRE></body>
</html>