{"id":63,"date":"2013-05-10T12:37:27","date_gmt":"2013-05-10T12:37:27","guid":{"rendered":"http:\/\/blogs.kent.ac.uk\/unseenit\/?p=63"},"modified":"2013-05-10T12:37:27","modified_gmt":"2013-05-10T12:37:27","slug":"office-and-shibboleth-2","status":"publish","type":"post","link":"https:\/\/blogs.kent.ac.uk\/unseenit\/office-and-shibboleth-2\/","title":{"rendered":"Office365 &amp; Shibboleth (2)"},"content":{"rendered":"<p>Something I forgot to mention in my earlier <a title=\"Office365 and Shibboleth\" href=\"http:\/\/blogs.kent.ac.uk\/unseenit\/2013\/02\/05\/office365-and-shibboleth\/\">post<\/a> about getting Shibboleth working with Office365 was our need to tweak the config a bit beyond what the whitepaper instructs.<\/p>\n<p>I was having a problem whereby the IdP was refusing to write a SAML assertion, I think just over ECP, because the NameID format it was trying to generate (<code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient<\/code>) wasn&#8217;t supported. Annoyingly the Shibboleth logs from when I encountered the problem have cycled away so I can&#8217;t quote the exact error message.<\/p>\n<p>Either way, with a bit of digging, I discovered <a href=\"https:\/\/aai-wiki.univie.ac.at\/PersistentId\">this page<\/a> (in Austrian\/German) which gave me enough of a hint to try editing my &lt;RelyingParty&gt; tag for MicrosoftOnline to include:<\/p>\n<pre>nameIDFormatPrecedence=\"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent\"<\/pre>\n<p>So my complete &lt;RelyingParty&gt; XML block is now:<\/p>\n<pre>\r\n&lt;!--&nbsp;Microsoft&nbsp;Windows&nbsp;Azure&nbsp;AD&nbsp;--&gt;\r\n&lt;rp:RelyingParty&nbsp;id=\"urn:federation:MicrosoftOnline\"\r\n&nbsp;&nbsp;&nbsp;provider=\"__ENTITYID__\"\r\n&nbsp;&nbsp;&nbsp;defaultSigningCredentialRef=\"IdPCredential\"\r\n&nbsp;&nbsp;&nbsp;nameIDFormatPrecedence=\"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent\"\r\n&nbsp;&nbsp;&nbsp;&gt;\r\n&nbsp;&nbsp;&nbsp;&lt;rp:ProfileConfiguration&nbsp;xsi:type=\"saml:SAML2SSOProfile\"\r\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;signAssertions=\"conditional\"\r\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;encryptAssertions=\"never\"\r\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;encryptNameIds=\"never\"&nbsp;\/&gt;\r\n&nbsp;&nbsp;&nbsp;&lt;rp:ProfileConfiguration&nbsp;xsi:type=\"saml:SAML2ECPProfile\"&nbsp;includeAttributeStatement=\"true\"\r\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;assertionLifetime=\"PT5M\"&nbsp;assertionProxyCount=\"0\"\r\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;signResponses=\"never\"&nbsp;signAssertions=\"always\"\r\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;encryptAssertions=\"never\"&nbsp;encryptNameIds=\"never\"\/&gt;\r\n&lt;\/rp:RelyingParty&gt;\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Something I forgot to mention in my earlier post about getting Shibboleth working with Office365 was our need to tweak the config a bit beyond &hellip; <a href=\"https:\/\/blogs.kent.ac.uk\/unseenit\/office-and-shibboleth-2\/\">Read&nbsp;more<\/a><\/p>\n","protected":false},"author":13,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/blogs.kent.ac.uk\/unseenit\/wp-json\/wp\/v2\/posts\/63"}],"collection":[{"href":"https:\/\/blogs.kent.ac.uk\/unseenit\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.kent.ac.uk\/unseenit\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.kent.ac.uk\/unseenit\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.kent.ac.uk\/unseenit\/wp-json\/wp\/v2\/comments?post=63"}],"version-history":[{"count":10,"href":"https:\/\/blogs.kent.ac.uk\/unseenit\/wp-json\/wp\/v2\/posts\/63\/revisions"}],"predecessor-version":[{"id":73,"href":"https:\/\/blogs.kent.ac.uk\/unseenit\/wp-json\/wp\/v2\/posts\/63\/revisions\/73"}],"wp:attachment":[{"href":"https:\/\/blogs.kent.ac.uk\/unseenit\/wp-json\/wp\/v2\/media?parent=63"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.kent.ac.uk\/unseenit\/wp-json\/wp\/v2\/categories?post=63"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.kent.ac.uk\/unseenit\/wp-json\/wp\/v2\/tags?post=63"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}