This site contains the documentation that is relevant to older WSO2 product versions and offerings.
For the latest WSO2 documentation, visit https://wso2.com/documentation/.

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Next »

 This section provides instructions on configuring the WSO2 Identity Server for WS-Federation with Office 365. 

Prerequisites

Azure AD expects to receive the following attributes with a SAML 2.0 message. 

 

ClaimClaim URIPurpose

UserPrincipal

http://schemas.xmlsoap.org/claims/UPN

This must be the email address of the Office365 user. Usually this is the userPrincipalName attribute in AD. Basically this is the login username that a user tries out to login for Office365. It should match with the domain name. (ex: wso2@wso2test.com).

Since this attribute requires an email address as the username, make sure you have configured the IS to authenticate users using the email address. See Using Email Address as the Username for more information.

ImmutableID

http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID

This is the Immutable ID that is set by the Azure AD sync service out of the box. If you use a different value, then this claim must be populated with that value for each user. So in this case we will use the ObjectGUID attribute in AD which is unique per user

Role

http://schemas.microsoft.com/ws/2008/06/identity/claims/role

The URI for a claim that specifies the role of a Windows user

Configuring Office 365 WS-Federation

  1. Start the WSO2 Identity Server and log in to the management console

  2. Navigate to the Identity Providers>List in the Main menu and click Resident Identity Provider. Expand the Inbound Authentication Configuration section and then the WS-Federation(Passive) Configuration.

  3. Replace the value of the Identity Provider Entity Id with the value given for the parameter $issueruri when configuring Azure AD (step 3 of this topic) , and click Update to save changes. 

  4. Navigate to Claims>Add in the Main menu and click Add New Claim. Set 'User Principle' and 'ImmutableID' as claims as seen below. See Adding Claim Mapping for more information. 

  5. Navigate to Claims>List and click on the http://wso2.org/claims claim dialect. Click on Edit for each of the claims below and untick the Supported by Default checkbox. 

    Why do these claims need to be edited?

    These attributes are not supported by Active Directory by default. Therefore if these attributes are ticked as Supported by Default in Identity Server, they will be shown in the default user profile and you will recieve an error once you try to update the user profile.

  6. Navigate to Service Providers > Add in the Main menu  and add a new Service Provider named ' Office365'. 

  7. Expand the  Inbound Authentication Configuration  section, then the  WS-Federation(Passive) Configuration and enter the following details. See Configuring WS-Federation Single Sign-On for more information about these fields. 

  8. Expand the Claim Configuration section and configure the following attributes required by Azure AD as seen below. 

    Service Provider ClaimLocal ClaimRequested Claim

    http://schemas.xmlsoap.org/claims/UPN

    http://wso2.org/claims/upn

    Ticked (True)

    http://schemas.microsoft.com/ws/2008/06/identity/claims/role

    http://wso2.org/claims/role

    Ticked (True)

    http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID

    		 http://wso2.org/claims/objectguidTicked (True)

     

  9. Set the Subject Claim URI to the Immutable ID claim and the Role Claim URI to the role claim. Click Update to save changes. 

  10. Create a user and update the user's profile with a User Principle Name as seen below. 

    ObjectGUID is a binary attribute. Add the following user store property to the <IS_HOME>/repository/conf/user-mgt.xml file under the relevant user store tag in order to see the value properly in the management console.

    <UserStoreManager ... >
...
<Property name="java.naming.ldap.attributes.binary">objectGUID</Property>
...
</UserStoreManager>

Testing Office 365 WS-Federation with WSO2 IS

WS-Federation eliminates the need to send passwords between Active Directory and Office 365, but it still requires synchronizing the user accounts with Azure AD. You can do this manually or you can automate the process. 

The following steps describe how to manually to synchronize a user with Azure AD. 

  1. Connect with Windows Azure AD Powershell module by executing the following commands.

    1. This command prompts  user credentials. 

      Run $cred=Get-Credential

      This will prompt for Windows Azure AD Admin credentials for the Office365 domain. The admin user’s domain credentials are usually in the following format: user@domain.onmicrosoft.com .

    2. This command connects with the stored credentials. Provided that the credentials are accurate, the connection will be successful. 

      Connect-MsolService –Credential $cred

    3. This command verifies the availability of the validated domain. This will return the Status and Authentication. The ‘Status’ of our domain should be ‘Verified’, and ‘Authentication’ should be ‘Managed’.

      Get-MsolDomain

  2. Run the following command to create a new user. 

    Use the value specified under objectGUID as -ImmutableId and the value specified under userPrincipalName, as the UserPrincipalName.

    New-MsolUser -UserPrincipalName wso2@wso2test.com -ImmutableID eDONEoBWe0SatxWqbZYobw== -LastName test -FirstName wso2 -DisplayName "WSO2 Test User"

You can now attempt to login to the Office365 Web Portal with this user you created. The user’s identity will be represented and authenticated by the on premises identity provider (i.e., the WSO2 Identity server).

 

  1. Access the following URL on your browser: https://login.microsoftonline.com/

  2. Enter the username along with the federated domain following this format: wso2@wso2test.com

    Note that this username is the same value specified as the the userPrincipleName.

  3.  

     You will be redirected to the login page of the WSO2 Identity Server’s authentication end point. Enter the correct user credentials and login.

  4.  

  • No labels