Forum Discussion
AltocumulusDo I have F5 APM SAML with Office 365 actually running?
Hi Jorge,
If correctly setup, this will happen when a user goes directly to www.office.com.
- User browses to www.office.com.
- www.office.com asks for the users e-mail address.
- User submits e-mail address.
- Based on the domain www.offfice.com will redirect the browser to the configured IDP (F5 APM).
- User authenticates to the IDP (F5 APM).
- After successful authentication browser gets redirected to www.office.com and has access to offfice resources.
You can use browsers plugins like 'SAML Tracer' to confirm that SAML is working correctly.
Jorge_ManyaHello Niels:
Thank you very much for your kind answer.
I understand the process, but how could I tell www.office.com to redirect the browser to the IdP (APM)? Currently, the users are being redirected to the ADFS server, but I would like them to go to the APM every time they try to access www.office.com directly. In other words, I want to get rid of such ADFS and I need the users use the APM site. I followed the guide located here https://www.f5.com/pdf/deployment-guides/microsoft-office-365-idp-dg.pdf and issued the commands on page 12. Did I miss something? Do I need to make changes in the Office 365 tenant to tell it that the new IdP is the APM and it needs to redirect the users to such IdP? I see SAML is working fine when the assertions sent by APM are successfully accepted by the SP (Office 365)
Again, so many thanks.
Hi Jorge,
Yes, the command on page 13:
Set-MsolDomainAuthentication –DomainName $dom –FederationBrandName $FedBrandName -Authentication Federated -PassiveLogOnUri $url -SigningCertificate $certData -IssuerUri $uri -ActiveLogOnUri $ecpUrl -LogOffUri $logouturl -PreferredAuthenticationProtocol SAMLP
should point to the F5 APM IDP virtual server. If this is set correctly, the SP (office.com) should redirec the user to the APM IDP when the user needs to authenticate first.
- Jorge_Manya
Hello Niels,
Yup, I issued the command on page 13 and it worked fine. I think that everything is set correctly, BUT there is an ADFS server which is acting as IdP for office.com first hand. I would like to get rid of such ADFS, in order to make the users be redirected to the APM instead of the ADFS.
So many thanks Sir.
If the $uri variable in the Set-MsolDomainAuthentication command points to the address of your BIG-IP then I don't understand how it in your case will redirect to something else than the BIG-IP.
