Configuring PingFederate server

Stop the PingFederate server.

Go to <pf-install>/pingfederate/server/default/data/config-store.

In a text editor, open the custom-name-formats.xml file.

If they are not already present, add the following lines to the sts-attribute-namespaces section:

<con:item name="http://schemas.microsoft.com/identity/claims">http://schemas.microsoft.com/identity/claims</con:item>;

<con:item name="http://schemas.microsoft.com/ws/2012/01">http://schemas.microsoft.com/ws/2012/01</con:item>;

<con:item name="http://schemas.microsoft.com/claims">http://schemas.microsoft.com/claims</con:item>;

Save your changes and restart the PingFederate server.

In a text editor, open <pf_install>/pingfederate/bin/run.properties and add the following line to the file:

org.apache.xml.security.ignoreLineBreaks=true

Save your changes and restart the PingFederate server.

Open the PingFederate administrative console and go to Server Configuration → Data Stores.

Click LDAP data store.

On the LDAP Configuration page, click Advanced.

In the Binary Attribute Namefield, enter objectSid and click Add. Click Save.

Open the existing Office 365 SP connection.

Go to SP Connection → WS-Trust STS → Protocol Settings.

In the Default Token Type list, select SAML 1.1 for Office 365. Click Save.

Go to SP Connection → WS-Trust STS → Token Creation - Attribute Contract.

Add the following attributes and corresponding attribute namespaces.

Click Next and then click the Kerberos Token Processor instance.

On the Attribute Sources & User Lookup tab, click the LDAP data store instance.

On the LDAP Directory Search tab, add the objectSid attribute to return from search. Click Next.

On the LDAP Binary Attribute Encoding Types tab, set the Attribute Encoding Type to SID for the objectSid attribute, then click Next.

Confirm that the LDAP Filter includes the following:

|((sAMAccountName=${username}) (userPrincipalName=${username}))

Click Done and Next until you reach the Attribute Contract Fulfillmentsection of the Kerberos Token Processor instance.

Populate the missing fields, then click Done.

Click the Username Token Processor instance, then click the Attribute Contract Fulfillment tab.

Populate the missing fields.

Click Save.