Facing Issues with MSOLService Deprecation — Best Practice for Azure SSO with OpenIAM?

Customer IAM (CIAM) SSO
22

Hi Dmytro,

Are you referring to assigning the authentication provider to a resource within a role? If so, yes—the user has a role that has the authentication provider assigned to it.

Best regards,
Aaron

23

Hi Dmytro,

I found a strange but repeatable behavior when trying to access Microsoft 365 via OpenIAM as the IdP.

Here’s the scenario:

  1. I’m already logged into OpenIAM in another tab (same browser session).

  2. When I go to https://portal.office.com, I get redirected to OpenIAM’s login page:

    https://example.com/idp/login?postbackUrl=%2Fidp%2Fsaml2%2Fidp%2Flogin

  3. On that page, I enter the username, but nothing happens — the password field doesn’t appear.

  4. If I manually change the URL to:

    https://example.com/idp/saml2/idp/login

    and hit enter, it logs me into Microsoft 365 successfully using the current OpenIAM session.

It seems like the SAML session is still active, and manually accessing the SAML endpoint bypasses the broken login flow. Is there an explanation for why the login page fails to render or redirect properly when accessed via the postbackUrl flow?

Could this be a login template issue or something misconfigured in the redirect handler?

Would appreciate any help or insight on how to fix this.

Thanks,
Aaron

24

Hi Aaron,

I will discuss your question with our team, and will come back to you shortly.

Best regards, Dmytro

1 Like
25

Hi Aaron,

Could you please share two screenshots from OpenIAM of uri patterns for: /idp/saml2/idp/login and /idp/saml2/idp/*

Best regards, Dmytro

Please follow this path:
webconsole → access control → content provider → your SAML connect provider → /idp/saml2/idp/login URI

webconsole → access control → content provider → your SAML connect provider → /idp/saml2/idp/login* URI

26

/idp/saml2/idp/*

cp1
cp11507×911 27 KB
cp2
cp21583×803 17.6 KB

/idp/saml2/idp/login

cp3
cp31507×825 24.3 KB

cp4
cp41538×860 17.9 KB

27

Hi Aaron,

Could you please change Supported Authentication levels for /idp/saml2/idp/login
Should be: Any Authentication

Best regards, Dmytro

1 Like
28

Hi Dmytro,

Thank you so much — it works now!

Just one more thing: OpenIAM sends the User Principal Name to Entra ID in the SAML request, but Entra expects the OnPremisesImmutableID. Is there a Groovy script template available that retrieves the objectGUIDof a user using the Azure AD connector and convert it to Base64 ?

Best regards,
Aaron

29

Hi Aaron,

As I understand, you would like to have OpenIAM verify the user by OnPremisesImmutableID from Azure SAML request
If yes, then you have to sync Azure users with OnPremisesImmutableID attribute using our PSGraph connector.
Regarding configuration OpenIAM I will discuss it with our team.

Best regards,
Dmytro

1 Like
30

Hi Aaron,

I have a question: How should OnPremisesImmutableID be represented in OpenIAM’s SAML request to Azure, as NameID in SAML request or as an additional attribute in SAML request?

Best regards,
Dmytro

1 Like
31

Hi Dymtro,

I believe it would be best if it’s represented as NameID instead!

Best regards,

Aaron

32

Hi Dmytro,

Any updates on this yet?

Best regards,
Aaron