Office 365 - Outlook and ADFS SSO - Disapointment

[FN-GM]

Im very disappointed. Turns out with ADFS outlook cannot be logged into office 365 seamlessly via SSO. The users have to enter a password again. Lync Clients is all seamless.

 

Really disappointed Microsoft! - Exchange is the biggest selling point of this product!

 

This may even stop the Office 365 project.

 

:(

[Boredguy]

Do you mean you have to enter every time you launch Outlook, or just for the first time so it can store your password?

[FN-GM]

Well if you have mandatory profiles it will be every time. If you reset the password you will need to enter it again. Compared to our onsite exchange this is rubbish! All our users click outlook it opens, automatically configures with no prompts at all.

[EduTech]

Hi,

 

are you saying that your users are asked to re-enter there password each time they launch outlook? can you describe the behavior in more detail if possible? Lync Client you will find that you do also have to type in the Username & Password during initial connect because this is an Active Client just like outlook. Lync on the other hand will login using a certificate and a new certificate will be requested using the stored credentials, and likewise if you update the UN/PW you will be asked to update these upon password change, also will happen in outlook.

 

- If you are using Office 2010 ensure that you have the SIA installed

- If you are using Office 2013 then the SIA is not required as a built-in lightweight version is included in the installer.

 

You will find that during initial configuration it will prompt you for the credentials, as these then get sent to Exchange Online and then Exchange Online initiates the token request via the WAP/Proxy.

 

If you do have those profiles, where the outlook profile is re-created each time then yes for sure you will be prompted to enter credentials each time you launch outlook.

 

James.

Edited June 9, 2014 by EduTech

[FN-GM]

Basically outlook opens and the user is prompted to enter a password.

 

We use Outlook 2013. We have local profiles so a teacher could be in 5 different rooms in a day. Retyping the password 5 different times isn't an option. Then the process start again when the password expires. Similar with the kids. The Lync client never asks for a password, even on first configuration. Just type your email address and you in (even that can be automated).

 

For us its a real show stopper. Moving to Office 365 will mean we will loose a function we use daily here.

 

Is there no way around this to make it behave like it does with on premise exchange?

 

Thanks

Edited June 9, 2014 by FN-GM

[FN-GM]

Everything else in Office 365 is pretty good. I feel let down, put loads of time into this to find a road block

[SYNACK]

Perhaps a hybrid setup where there is a local exchange box with no accounts on it, this set up in hybrid mode with 365. Depending on how outlook and exchange behave if outlook is fed the local server on account setup it should authenticate you then hand you off to 365, it may manage to use the existing auth details without a prompt.

 

If it works its a nasty hack but most stuff seems to be with 365.

[FN-GM]

We have a hybrid setup ready to migrate the accounts. You are still prompted for Office 365 mailboxes. Edited June 9, 2014 by FN-GM

[Edu-IT]

The benefit of having Office 365 outweigh having to enter password, surely?

[FN-GM]

No not really. We shouldn't loose features. The main benefit of 365 is the quota, but that isn't an issue for us at the moment with our on premise setup. Or internal Exchange hardware will last for another 5 years so no costing in renew it etc. The current setup is working a sweet as a nut.

 

This will just make the end user experience suffer. Something that is really important. Very close the top of the agenda.

Edited June 9, 2014 by FN-GM

[Edu-IT]

No not really. We shouldn't loose features. The main benefit of 365 is the quota, but that isn't an issue for us at the moment with our on premise setup. Or internal Exchange hardware will last for another 5 years so no costing in renew it etc. The current setup is working a sweet as a nut.

 

This will just make the end user experience suffer. Something that is really important. Very close the top of the agenda.

If your on premise solution is working, what are the reasons for moving, out of interest?

 

I'd say typing in a password is something that end users should be able to cope with and as it's the only option if you go Office 365, they have little to no choice.

Edited June 9, 2014 by Edu-IT

[FN-GM]

Getting ready for the future, get rid of the time spent patching, backup monitor, testing recover testing etc. The technical support is a safety net as well.

 

Its not they won't be able to cope its all about experience. People complain about Windows 8 start screen, they don't like the experience but they still cope with it. Rather than make the experience worse for the users i would rather do the above.

[EduTech]

Hi,

 

The reason you don't have the issue with Lync is because the authentication flow is different, Lync Online follows the following authentication flow when using AD FS

 

1. First the user login to there machine/client

2. After they login the sign in assistant kicks in

3. The sign in assistant already know the UPN etc. of the user and goes directly to the Authentication Platform

4. The Authentication Platform return the URL to the sign in assistant pointing to the ADFS server .

5. The sign in assistant then goes to the ADFS server and authenticate via Kerberos or NTLM and when the it’s authenticated, the ADFS server gives the user an SAML token including the claims: UPN and Source User ID (ImmutableID).

6. The sign in assistant take the token to the Authentication Platform

7. The Authentication Platform verifies the token and converts it to an Auth token, which contain the UPN and now Unique ID from the Authentication Platform. This Auth. token can now be used for login.Note all above happens at logon and the users doesn’t see it.

8. Now the user starts Lync

9. Lync connects to Lync Online

10. Lync Online request a Auth. Token

11. The client have one of those and sends it to Lync Online

 

where as Outlook/Active Sync does the following:

 

1. The user login and the sign in assistant kick in as above and do the round-trip to get the Auth. token.

2. Now the user starts Outlook

3. Outlook connect to Exchange Online and it will request Basic authentication

4. The user will get at prompt and here they need to type in there username with an UPN ex. [email protected] they can save this, but they will get prompted the first time.

5. This will be send off to Exchange Online

6. Now Exchange Online does a trick called “Proxy Auth” where it creates a shadow representation of the user.

7. It then take the domain/UPN from the basic authentication and sends it to the Authentication Platform.

8. The Authentication Platform returns with the URL to the ADFS server.

9. Exchange Online then takes the basic authentication credential and sends them to the ADFS server.

10. The ADFS server authenticate with the basic credentials and converts them to a SAML token including the claims: UPN and Source User ID (ImmutableID).

11. This comes back to Exchange Online

12. Exchange Online sends it to the Authentication Platform

13. The Authentication Platform verifies the token and converts it to an Auth token, which contain the UPN and now Unique ID from the Authentication Platform. This Auth. token can now be used for login.

14. Exchange Online can now authenticate the user and it will delete the shadow representation of the user.

 

It is by design, if your using that type of profile then there is nothing more we can really do from an Exchange Online Perspective.

 

Regards,

James.

[FN-GM]

Really if it can be done with on premise it can be done with with 365 (obviously some work from MS is required). It wouldn't be so bad if OWA wasn't missing stuff we use.

 

Its MS AD, MS Outlook and MS 365 - They should make this work some how! MS are the king with authentication and identity management!

 

might leave 365 this week an work on something else.

Edited June 9, 2014 by FN-GM

[EduTech]

The reason why it does not work how you want is primarily because of the following

 

4. The user will get at prompt and here they need to type in there username with an UPN ex. [email protected] they can save this, but they will get prompted the first time.

5. This will be send off to Exchange Online

6. Now Exchange Online does a trick called “Proxy Auth” where it creates a shadow representation of the user.

7. It then take the domain/UPN from the basic authentication and sends it to the Authentication Platform.

8. The Authentication Platform returns with the URL to the ADFS server.

9. Exchange Online then takes the basic authentication credential and sends them to the ADFS server.

 

Because the authentication request to AD FS comes from Exchange Online it goes via the Web Application Proxy / AD FS Proxy and uses the /usernamemixed endpoint and it uses the credentials provided at the prompt to then get a SAML token.

 

.....

 

If you take the browser, this is a passive authentication request and so in this scenario on a Domain-Joined Machine it will talk with the OnPremise AD FS Server and use Windows Integrated Authentication which allows seamless sign-in experience.

 

Likewise with Lync, Because it uses the SIA that does the negotiation element with authentication service and then goes and gets a token from AD FS which then it sends to Lync Online which then provides your users with a certificate which will be present in the Local Certificate Store which is valid for ~ 8 Hours and it uses that then to authenticate against the service.

 

... for now, it is by design. The behavior your are experiencing although I understand your point is caused because your users have a new profile each time they sign-in to the Exchange Online service. I imagine there profile is also downloaded each time etc. also.

 

James.

[FN-GM]

Well its not really a profile issue either, when a password is reset you to stick it in outlook again. I have known companies to reset every 7 days. I know its by design but the design stinks!

[EduTech]

I suppose, but if you understand the authentication flow then you will understand the reasons behind why you experience such. I guess you have to just consider, and think about the following points:

 

- Giving new users a new profile each time they sign-in to a machine, is it really the best way for your organization?

- Increase password complexity & increase the amount of time until password change to minimize disruption over a 12 month period.

 

You really need to weigh up the pro's and con's of having a cloud service and on-premise deployment, if that behavior is a real issue for you and will stop you from adopting Office 365 in favor of managing this infrastructure on-premise for such experience then that is a choice only you can make.

 

Let me put it in this scenario....

 

If i understand you correctly in terms of what your users experience, is having them to click Next, Next, Next etc. the best experience for them each time they need to launch outlook? surely them just being able to open outlook and get access to there e-mail is much preferred... yet they have to cope with that change? right....

 

:-)

 

James.

[FN-GM]

But there are still ways to make Outlook work like Lync does. For the long term things need to change in the way Outlook authenticates. Anyway im not here to argue about it. Don't want to be here all night.

 

Our users don't press next, next, next outlook is automatically configured for them. Group policy is your friend! So they already just open outlook and read emails. With 365 there is an added step. Open outlook, enter password and read emails. So you are right, just being able to open outlook and access email is much preferred, thats why the 365 way is causing problems. But that isn't the issue, even with the local profiles where the configuration is stored they will have to stick the password in on each machine. Roaming profiles have a hit on logon performance and redirected app data has its own issues.

Edited June 9, 2014 by FN-GM

[Boredguy]

Originally I thought you were looking at ADFS as a method to restrict Outlook usage/Storage outside of the school environment?

There is always compromised with moving services off site, and it may be you need to see if Roaming profiles may be a better choice to local profiles if you wish to have the Outlook authentication only on initial use and subsequent password changes.

 

We have all our staff network accounts as roaming profiles, but for students use mandatory ones. Since moving to 365 back in August I've not encountered an issue with the integration with Outlook 2013 and 365 once staff enter their password the initial time, which is the same as our previous mail solution.

 

As @EduTech said, it's the design process and we all know that some Microsoft Applications never seem to want to behave in a manner that we expect them to. Heck I had to spend a while working out how to redirect the OST files from the local profile path as I clear user accounts off workstation at logoff and the official documentation says that OST redirection does not work with 2013.... well it does if you get the right fields in registry and GPO but does limit the number of instances users be in of Outlook to 1 (which is no bad thing really).

[FN-GM]

Originally I thought you were looking at ADFS as a method to restrict Outlook usage/Storage outside of the school environment?

 

As well as this yes. At first (very early days) i thought you could get SSO without ADFS. But When you didn't i set that up.

 

There is always compromised with moving services off site, and it may be you need to see if Roaming profiles may be a better choice to local profiles if you wish to have the Outlook authentication only on initial use and subsequent password changes.

 

We have all our staff network accounts as roaming profiles, but for students use mandatory ones. Since moving to 365 back in August I've not encountered an issue with the integration with Outlook 2013 and 365 once staff enter their password the initial time, which is the same as our previous mail solution.

 

Local profile have a performance hit, plus you get the prompt again when you reset the password.

 

As @EduTech said, it's the design process and we all know that some Microsoft Applications never seem to want to behave in a manner that we expect them to. Heck I had to spend a while working out how to redirect the OST files from the local profile path as I clear user accounts off workstation at logoff and the official documentation says that OST redirection does not work with 2013.... well it does if you get the right fields in registry and GPO but does limit the number of instances users be in of Outlook to 1 (which is no bad thing really).

 

I agree, but design isn't perfect, infact any design anywhere is hardly ever perfect.

 

 

So i ask myself why leave my on premise system for something that is interior?

Edited June 9, 2014 by FN-GM

[Boredguy]

I believe you mean inferior as interior and on premise is the same thing

 

You will always get a prompt to re-enter your password when you change it in Outlook.... or at least I've had to for the last 17 years but I've not had an on premise Exchange server to worry about since the 5.5 days.

 

I would debate the performance hit issue as it can be managed but it depends on how your system is setup as all of us are different and you do know your own network so it's a debate for another year

 

Compare the pro's and con's for running onsite verses cloud and then maybe ask some of your users how they would feel to the compromise to give an indication if it is worth the additional time for you to apply the patches etc for the on premise compared to staff typing in their password again if required.

On the whole it's another Outlook design feature

[FN-GM]

You will always get a prompt to re-enter your password when you change it in Outlook.... or at least I've had to for the last 17 years but I've not had an on premise Exchange server to worry about since the 5.5 days.

 

Been using Exchange since version 2003. I have never seen that. When an AD password is changed you login and outlook functions as usual. Must have been changed when they linked the accounts to AD.

Edited June 9, 2014 by FN-GM

[EduTech]

Sure, as of today that is how things work and so i hope the information has answered your question. I appreciate that it's not exactly what you want to hear but in your deployment state that is how things will be in terms of an experience, unless anything major changes in the authentication flow in the future that takes your scenario into account.

 

I know many people on here don't even use AD FS and use Password Sync and although they have the do click on Remember Password even if they were to have your scenario they would be hit with the same issue, not just AD FS with O365.

 

====

 

- The fact your User Profiles get re-built each time is something that has not been taken into consideration and so hence your lack of SSO Experience.

- In terms of the authentication prompt when a password is changed, this is because the credentials are stored in Credential Manager and so in order to update them, it needs to prompt for new credentials.

 

====

 

Remember, Your Exchange On-Premise Environment has clean access to authenticate your users against your DCs via Kerberos etc. and so in way let's say it has privileged access to do such where as Exchange Online if using Federated Identity does not have the ability to do that and so has to via the WAP/Proxy and so yes the behavior is that you will be prompted and in essence this will only be Once or Password is Changed and in the case of your scenario every time someone logs on due to how you manage your user profiles across the organization.

 

Thanks.

James.

[FN-GM]

I know many people on here don't even use AD FS and use Password Sync and although they have the do click on Remember Password even if they were to have your scenario they would be hit with the same issue, not just AD FS with O365.

 

More people might use ADFS if outlook SSO worked - Besides just cause others put up with it doesn't make it right. We all put up with the rubbish weather, doesn't mean we like it

 

Thanks for your input

 

PS: I assume not but is there anything 3rd party or anything that i can get around this issue? Worth a shot!

Edited June 9, 2014 by FN-GM

[EduTech]

The authentication flow will be the same which ever authentication provider you use.

 

P.S. I have taken this information and will of course feed this back in to the relevant PG teams.

 

Thanks,

James.