Login to Office 365 with ws-trust enabled applications fail when WS-Trust MEX Metadata Is Larger than 65 KB

• Access Manager setup to federate with Office 365 using ws-federation and ws-trust protocols. Everything working well from browser based applications and Office thick clients that are ADAL enabled.
  
  
• Applications running on mobile platforms often need to retrieve the ws-trust metadata, in order to get access to key endpoints to send requests to. Examples of this include if you want to register join / register Windows Workstation to Azure in Hybrid Mode, or if you want to login your workstation to Azure in Hybrid Mode to do something Intune.
  
  
• This request is typically a SOAP request POSTed to the /nidp/wstrust/sts/mex link on NAM, and the response includes binding information and URLs. Some applications will log the fact that there are metadata issues, whilst others will return generic application errors. Capturing the requests from the app using Fiddler shows that the problem occurs after the metadata request goes out, and without any response even though the metadata exists.

• edit the "/opt/novell/nam/idp/webapps/nidp/WEB-INF/web.xml" file
• search for "NetIQSTS"
• The very first entry should be:

<servlet>
  <servlet-name>NetIQSTS</servlet-name>
  <servlet-class>com.novell.nidp.wstrust.servlet.CustomSTSServlet</servlet-class>
  <load-on-startup>1</load-on-startup>
</servlet>

• modify the section to look like below (changes in red)
  

<servlet>
  <servlet-name>NetIQSTS12MEX</servlet-name>
  <jsp-file>/jsp/mex.jsp</jsp-file>
  <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
  <servlet-name>NetIQSTS12MEX</servlet-name>
  <url-pattern>/wstrust/sts/mex</url-pattern>
</servlet-mapping>
<servlet>
  <servlet-name>NetIQSTS</servlet-name>
  <servlet-class>com.novell.nidp.wstrust.servlet.CustomSTSServlet</servlet-class>
  <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
  <servlet-name>NetIQSTS</servlet-name>
  <url-pattern>/wstrust/sts</url-pattern>
</servlet-mapping>
<servlet-mapping>
  <servlet-name>NetIQSTS</servlet-name>
  <url-pattern>/wstrust/sts/saml</url-pattern>
</servlet-mapping>
<servlet-mapping>
  <servlet-name>NetIQSTS</servlet-name>
  <url-pattern>/wstrust/sts/active12</url-pattern>
</servlet-mapping>
<!--
<servlet-mapping>
  <servlet-name>NetIQSTS</servlet-name>
  <url-pattern>/wstrust/sts/mex</url-pattern>
</servlet-mapping>
-->

• restart the IDP server in order to apply the change