<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
Keep in mind that this will not work if you are intending to use Entra Join. In that case MS requires that the federated IdP supports WS-Trust/WS-Fed[0] that Shib IdP does not support.
<div><br>
</div>
<div>Youssef</div>
<div><br>
</div>
<div>[0] <a href="https://learn.microsoft.com/en-us/entra/identity/devices/device-join-plan#federated-environment">https://learn.microsoft.com/en-us/entra/identity/devices/device-join-plan#federated-environment</a></div>
<div>--------------------<br>
<div>
<blockquote type="cite">
<div>On 28 Jul 2025, at 15:04, Bobby Lawrence via users <users@shibboleth.net> wrote:</div>
<br class="Apple-interchange-newline">
<div>
<div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
Just an FYI - its entirely possible to configure Entra to delegate authentication to Shibboleth (so that Entra acts as a SAML proxy). We have our tenant configured exactly this way so that at our organization doesn't need to sync passwords to them in the cloud.<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<a href="https://urldefense.com/v3/__https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-saml-idp__;!!JFdNOqOXpB6UZW0!vsP7choDJ211RrnN_UNJXWWYOGfEHfL1lhERIS93NpjOsGYz5pqrCKE7n8l4Z5-h9frZ0kWqUC9pKDKkmp-6twdkUw$" style="color: purple; text-decoration: underline;">https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-saml-idp</a><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></span></div>
<div style="border-width: medium medium medium 1.5pt; border-style: none none none solid; border-color: currentcolor currentcolor currentcolor blue; border-image: none; padding: 0in 0in 0in 4pt;">
<div>
<div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentcolor currentcolor; border-image: none; padding: 3pt 0in 0in;">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<b><span style="font-size: 11pt; font-family: Calibri, sans-serif;">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;"><span class="Apple-converted-space"> </span>users <<a href="mailto:users-bounces@shibboleth.net" style="color: purple; text-decoration: underline;">users-bounces@shibboleth.net</a>><span class="Apple-converted-space"> </span><b>On
Behalf Of<span class="Apple-converted-space"> </span></b>Baron Fujimoto via users<br>
<b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, July 24, 2025 8:46 PM<br>
<b>To:</b><span class="Apple-converted-space"> </span>Cantor, Scott <<a href="mailto:cantor.2@osu.edu" style="color: purple; text-decoration: underline;">cantor.2@osu.edu</a>><br>
<b>Cc:</b><span class="Apple-converted-space"> </span>Baron Fujimoto <<a href="mailto:baron@hawaii.edu" style="color: purple; text-decoration: underline;">baron@hawaii.edu</a>>; Shib Users <<a href="mailto:users@shibboleth.net" style="color: purple; text-decoration: underline;">users@shibboleth.net</a>><br>
<b>Subject:</b><span class="Apple-converted-space"> </span>[EXTERNAL] Re: Using the IdP behind Entra?<o:p></o:p></span></div>
</div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<o:p> </o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
It's entirely possible I've reversed the directional terminology; I was thinking of it from the user's perspective where they would have Entra as the login UX, but the SPs and applications are still interacting with the IdP. Would this be proxying the authentication
from the IdP's perspective?<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<o:p> </o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
Thank you for the confirmation on the references as well as the pointers to the Microsoft and IdP KB references. I'll take a closer look now that I know that's the path forward. Hopefully I can begin to connect the dots and flesh things out between the general
SAML Authn Configuration page and the specific IdPv5 KB example for Entra. Hopefully in the process it will become clearer how this applies to the CAS aspects. I'm sure I'll have more questions when I know more about what I don't know and can ask more intelligent
questions about it.<o:p></o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<o:p> </o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
But thank you for at least providing us for now with a baseline confidence that we can proceed with our CAS protocol unification efforts and that we have a viable path forward with this.<o:p></o:p></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<o:p> </o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<o:p> </o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<o:p> </o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<o:p> </o:p></div>
</div>
</div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<o:p> </o:p></div>
<div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
On Thu, Jul 24, 2025 at 11:35 AM Cantor, Scott <<a href="mailto:cantor.2@osu.edu" style="color: purple; text-decoration: underline;">cantor.2@osu.edu</a>> wrote:<o:p></o:p></div>
</div>
<blockquote style="border-width: medium medium medium 1pt; border-style: none none none solid; border-color: currentcolor currentcolor currentcolor rgb(204, 204, 204); border-image: none; padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;">
<p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: "Times New Roman", serif;">
I kind if suspect you're reversing the normal directonal terminology.<br>
<br>
Putting Entra "in front" would mean integrating applications against Entra and authenticating users to Entra with Shiibboleth and I imagine that's perhaps not possible. Entra probably can't delegate to another SAML IdP. I could be wrong.<br>
<br>
Proxying authentication of Shibboleth to Entra is very trivial. The docs for that are the ones you found. The KB articles are a supplement, there's one for V4 and one for V5, but they are not the primary source.<br>
<br>
The IdP can proxy authentication to anything else but still issue CAS tickets or SAML assertions out without any problems.<br>
<br>
-- Scott<br>
<br>
<o:p></o:p></p>
</blockquote>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<br clear="all">
<o:p></o:p></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<o:p> </o:p></div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span class="gmailsignatureprefix">--<span class="Apple-converted-space"> </span></span><o:p></o:p></div>
<div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;">
<span style="font-family: Arial, sans-serif;">Baron Fujimoto <<a href="mailto:baron@hawaii.edu" target="_blank" style="color: purple; text-decoration: underline;">baron@hawaii.edu</a>> ::: UH Information Technology Services<br>
minutas cantorum, minutas balorum, minutas carboratum descendus pantorum</span><o:p></o:p></div>
</div>
</div>
</div>
</div>
<span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">--<span class="Apple-converted-space"> </span></span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">For
Consortium Member technical support, see<span class="Apple-converted-space"> </span></span><a href="https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!JFdNOqOXpB6UZW0!vsP7choDJ211RrnN_UNJXWWYOGfEHfL1lhERIS93NpjOsGYz5pqrCKE7n8l4Z5-h9frZ0kWqUC9pKDKkmp-wIrHEhw$" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!JFdNOqOXpB6UZW0!vsP7choDJ211RrnN_UNJXWWYOGfEHfL1lhERIS93NpjOsGYz5pqrCKE7n8l4Z5-h9frZ0kWqUC9pKDKkmp-wIrHEhw$</a><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;"><span class="Apple-converted-space"> </span></span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">To
unsubscribe from this list send an email to<span class="Apple-converted-space"> </span></span><a href="mailto:users-unsubscribe@shibboleth.net" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br>
</div>
</body>
</html>