How To: Configure the Dynamic Issuer for a Multidomain Office 365 Environment

Version Affected: 8.2 and later

 

Overview

This article explains how to configure the dynamic issuer feature for a multidomain Office 365 environment, so that each federated domain sends a unique Security Assertion Markup Language (SAML) Issuer value from a single realm.

If an Office 365 tenant has multiple domains federated for authentication, Microsoft requires each of those domains to be created with the SupportMultiDomains flag set to True. If a domain was created without this flag, it must be updated before continuing — refer to Microsoft's documentation for creating, updating, and removing domains in an Office 365 tenant.

Each domain in the Office 365 tenant must use a unique Issuer for federated authentication. Rather than configuring a separate realm per domain, Identity Platform can dynamically send the correct Issuer from a single realm, based on the authenticating user's User Principal Name (UPN). Before continuing, note the Issuer being used for each federated domain from your Office 365 configuration.

Configure the Dynamic Issuer

1. On each domain's Data tab — for both the WS-Federation realm and the WS-Trust realm — map UPN to the AUXID9 field, as shown below. For example, if SecureAuth1 is domain 1, SecureAuth2 is domain 2, and SecureAuth3 is the webservice realm pointing to both, make this change on both SecureAuth1 and SecureAuth2.

2. Go to the System Info tab of the same realm.
3. Select Edit Web config, then search for DynamicIssuer.
4. Change DynamicIssuerEnabled to true.
5. Set DynamicIssuerUpnAttr to 19. AUXID9 maps to value 19 in the SecureAuth web.config. If you are using a different profile field for the UPN mapping, contact SecureAuth Support for the correct value.
6. Set DynamicIssuerUPNList to a comma-separated list in the form UniqueIssuer1|lastpartofUPNfordomain1,UniqueIssuer2|lastpartofUPNfordomain2. For example: https://domain.com|domain.com,https://domain.net|domain.net, as shown below.

You can add multiple issuer names separated by commas, provided the corresponding domain is part of the multidomain configuration on the Data tab, and the corresponding UPN is mapped to the correct field on that domain's Data tab.

If this is not configured correctly, the Issuer sent back in the claims defaults to the Issuer name configured on the Post Authentication tab instead, as shown below.

Special Considerations

The DynamicIssuerUpnAttr value for AUXID1 is 9. AUXID2 is 12, and the value increments by 1 for each AUXID after that — for example, AUXID3 is 13, and AUXID7 is 17.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.