Forum Discussion

Kevin_Davies_40's avatar
Sep 28, 2017

Office 365 SAML idp and Outlook 2016 solution?

Does anyone know when F5 expect the Office 365 SAML idp endpoint to support thick client Outlook 2016 authentication for federated domains?

 

https://f5.com/solutions/deployment-guides/microsoft-office-365-saml-idp-big-ip-v11-apm

 

Our Outlook clients were no longer able to connect to exchange online after federating to F5 APM with SAML.

 

  • This was due to a federation issue. You need to wait 24-48 hours after de-federating from ADFS before you federate to F5 idp.

     

  • This was due to a federation issue. You need to wait 24-48 hours after de-federating from ADFS before you federate to F5 idp.

     

    • Niels_van_Sluis's avatar
      Niels_van_Sluis
      Icon for MVP rankMVP

      Hi Kevin, good to hear you found a solution. Could you help me and try something out for me. I have also deployed the F5 APM to fully replace ADFS and everything seems to be working fine. There is only one issue with shared licenses in a non persistent VDI environment and I'm not sure if the problem is within my F5 APM configuration or within Office 365/Azure. I'm trying to validate my setup using the Microsoft connectivity test, but I'm not sure if this test is reliable. Could you run a test on your setup and share your results?

      What I do is:

      In my setup it fails with the following messages:

      An error was found in the domain registration.
      Additional Details
      The Metadata Exchange URL in the domain registration isn't valid. URL:
      Elapsed Time: 1 ms.
      

      We have set the metadataexchangeuri, so I wonder if I can ignore this error. I would like to know if your setup shows the similar error messages.

    • Kevin_Davies_40's avatar
      Kevin_Davies_40
      Icon for Nacreous rankNacreous

      I am unable to do this as we had to revert to ADFS. Another script we use to map drives to sharepoint is heavily dependant on ADFS.. it actually scrapes information from ADFS webpages! So I am adapting that at the moment, only 3000 lines of powershell 8-|

      But I recall the metadata exchange URL didn't change for us as well. The federation command does not seem to affect this URL at all. I believe you have to manually set this yourself using ...

      Set-MsolDomainFederationsettings -DomainName  -MetadataExchangeUri 
      
    • Kevin_Davies_40's avatar
      Kevin_Davies_40
      Icon for Nacreous rankNacreous

      Please note i have updated the comment above, the MetadataExhangeUri has nothing to do with SAML exported meta data. It is not needed in a SAML environment so you can delete it. Try setting it to "" to clear it.

       

  • Hi Kevin,

     

    I'm going to configure my F5 like SAML IDP for federation of Office365. Federation seems works fine, if I try to reach Office365 from the website https://login.microsoftonline.com login works fine and the access is successfully granted. I encountered some issue using the Outlook client. How do you solved your access problem described before?

     

    Thanks in advance for your answer.