Skip to content

Corrections for HOWTO Configure Shibboleth IdP v4.x for Office 365.md #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Corrections for HOWTO Configure Shibboleth IdP v4.x for Office 365.md #57

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions ...OWTO-Shibboleth/Solutions/HOWTO Configure Shibboleth IdP v4.x for Office 365.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@

## Instructions

Reference: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-saml-idp

1. Into `conf/relying-party.xml`, under `<util:list id="shibboleth.RelyingPartyOverrides">`, add the following `<bean>`:
```xml
<bean id="Office365" parent="RelyingPartyByName" c:relyingPartyIds="urn:federation:MicrosoftOnline">
Expand Down Expand Up @@ -54,7 +56,7 @@
<InputDataConnector ref="myLDAP" attributeNames="objectGUID"/>
</AttributeDefinition>

<AttributeDefinition scope="%{idp.scope}" xsi:type="Scoped" id="UserId">
<AttributeDefinition scope="%{idp.scope}" xsi:type="Scoped" id="IDPEmail">
<InputDataConnector ref="myLDAP" attributeNames="uid"/>
</AttributeDefinition>
```
Expand All @@ -70,28 +72,26 @@
description.en=Azure AD ImmutableID
description.it=Azure AD ImmutableID
saml2.name=urn:oid:1.2.840.113556.1.4.2
saml1.encodeType=false
saml2.encodeType=false
```

5. Create `conf/attributes/custom/UserId.properties` as follow (the example considers italian and english languages only):
5. Create `conf/attributes/custom/IDPEmail.properties` as follow (the example considers italian and english languages only):
```properties
# Azure AD User ID
# Azure AD IDPEmail

id=UserId
id=IDPEmail
transcoder=SAML2ScopedStringTranscoder
displayName.en=Azure AD User ID
displayName.it=Azure AD User ID
description.en=Azure AD User ID
description.it=Azure AD User ID
saml2.name=urn:oid:0.9.2342.19200300.100.1.1
saml1.encodeType=false
displayName.en=Azure AD IDPEmail
displayName.it=Azure AD IDPEmail
saml2.name=IDPEmail
saml2.friendlyName=
saml2.nameFormat=
saml2.encodeType=false
```

6. Create Office 365 metadata:
* `wget https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml -O /opt/shibboleth-idp/metadata/office365-md.xml`

(and remove the NameIDFormat "`unspecified`" or the relase NameID will be always "`transient`")

7. Into `conf/metadata-providers.xml` add the Office 365 metadata:
```xml
<MetadataProvider id="Office365" xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/office365-md.xml"/>
Expand All @@ -104,7 +104,7 @@
<PolicyRequirementRule xsi:type="Requester" value="urn:federation:MicrosoftOnline" />

<!-- Release userPrincipalName as Azure AD User ID -->
<AttributeRule attributeID="UserId">
<AttributeRule attributeID="IDPEmail">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>

Expand Down