Office 365 - Configuração no Shibbboleth IDP

<bean id="Office365" parent="RelyingPartyByName" c:relyingPartyIds="urn:federation:MicrosoftOnline">
   <property name="profileConfigurations">
      <list>
         <bean parent="SAML2.SSO" p:encryptAssertions="false" p:signAssertions="true" p:signResponses="false" />
         <bean parent="SAML2.ECP" p:encryptAssertions="false" p:signAssertions="true" p:signResponses="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
      </list>
   </property>
</bean>

<!-- CAFe- Persistent NameID -->
<bean parent="shibboleth.SAML2PersistentGenerator">
   <property name="activationCondition">
      <bean parent="shibboleth.Conditions.NOT">
         <constructor-arg>
            <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="urn:federation:MicrosoftOnline" />
         </constructor-arg>
      </bean>
   </property>
</bean>

<!-- CAFe - Persistent NameID exclusivo para Microsoft -->
<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
      p:omitQualifiers="true"
      p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
      p:attributeSourceIds="#{ {'ImmutableID'} }">
   <property name="activationCondition">
      <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="urn:federation:MicrosoftOnline" />
   </property>
</bean>

<!-- CAFe - ImmutableID para Microsoft -->
<AttributeDefinition xsi:type="Simple" id="ImmutableID">
   <InputDataConnector ref="dcLDAP" attributeNames="entryUUID"/>
</AttributeDefinition>

<!-- CAFe - UserId para Microsoft -->
<AttributeDefinition scope="%{idp.scope}" xsi:type="Scoped" id="UserId">
   <InputDataConnector ref="dcLDAP" attributeNames="uid"/>
 </AttributeDefinition>

<ReturnAttributes>%{idp.authn.LDAP.returnAttributes} mail cn givenName sn brPersonCPF schacDateOfBirth entryUUID</ReturnAttributes>

# Microsoft Entra ImmutableID

id=ImmutableID
transcoder=SAML2StringTranscoder
displayName.en=Microsoft Entra ImmutableID
displayName.pt-br=Microsoft Entra ImmutableID
description.en=Microsoft Entra ImmutableID
description.pt-br=Microsoft Entra ImmutableID
saml2.name=urn:oid:1.2.840.113556.1.4.2
saml1.encodeType=false

# Microsoft Entra User ID

id=UserId
transcoder=SAML2ScopedStringTranscoder
displayName.en=Microsoft Entra User ID
displayName.pt-br=Microsoft Entra User ID
description.en=Microsoft Entra User ID
description.pt-br=Microsoft Entra User ID
saml2.name=urn:oid:0.9.2342.19200300.100.1.1
saml1.encodeType=false

<MetadataProvider id="Office365" xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/microsoft-md.xml"/>

wget https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml -O /opt/shibboleth-idp/metadata/microsoft-md.xml

<AttributeFilterPolicy id="PolicyForMicrosoftEntra">
   <PolicyRequirementRule xsi:type="Requester" value="urn:federation:MicrosoftOnline" />
   
   <AttributeRule attributeID="UserId">
      <PermitValueRule xsi:type="ANY"/>
   </AttributeRule>
   
   <AttributeRule attributeID="ImmutableID">
      <PermitValueRule xsi:type="ANY"/>
   </AttributeRule>

</AttributeFilterPolicy>