Office 365 ADFS SSO Problem

[Norphy]

I have got a case open with Microsoft about this but I thought I'd put it to the Edugeek hive mind to see if anyone has had a similar issue and solved it.

 

We're setting up Office 365 for our staff and students. I'm not sure what exactly we're going to do with it but you know, it's cloud so it must be good. We want to set it up for SSO so our users don't have to remember yet another username and password. To that end, I've set up a pair of W2012 servers with the ADFS role on one and the ADFS proxy role on the other and set up a relying party trust between it and Azure. I've made the lutonsfc.ac.uk domain a federated one.

 

Users can sign onto O365 on external PCs, i.e. over the internet. Users can sign onto O365 using the ADFS server itself. However, when someone tries to sign onto O365 from inside the network, they get a what looks like a Windows authentication prompt asking for credentials. You put in your network username and password and it pops up again. The connectivity tests at https://www.testexchangeconnectivity.com/ all pass so it looks like federation is working OK and that my certificates are correct.

 

I'm at a loss and I don't know what to try next! It has to be some stupid little IIS setting because otherwise you wouldn't be able to sign on from the outside or on the ADFS server. Any suggestions?

 

Cheers!

 

/edit

 

Just tried it in Firefox, it works! Firefox doesn't support a lot of the Windows authentication methods that IE and Chrome do so maybe it isn't IIS, maybe it's a security setting in IE.

 

Argh!

 

/edit 2

 

Turning off integrated authentication in IE allows you to sign in. And it doesn't even ask for authentication. WTF?

Edited April 15, 2013 by Norphy

[Norphy]

Microsoft called me back today and gave me the solution.

 

On both the ADFS server and ADFS proxy, you need to turn off the Negotiate authentication provider on the Windows authentication method for the ADFS/LS Application. Doing that solved the problem! Now to get Lync working through or around the firewall!

[EduTech]

Hi,

 

I am pleased that you managed to get this resolved, I have not had chance to reply back to you today but that is indeed correct, also note that it is recommended under the adfs/ls node in IIS you right click Windows Authentication under Authentication and choose Advanced Settings. Turn off Extended Protection..

 

-Edit- For Reference, The latter setting is generally related to browsers such as Chrome/Firefox etc. NOT Internet Explorer which does support Extended Protection unlike the other browsers.

 

Regards,

James.

Edited April 15, 2013 by EduTech

[Edu-IT]

Microsoft called me back today and gave me the solution.

 

On both the ADFS server and ADFS proxy, you need to turn off the Negotiate authentication provider on the Windows authentication method for the ADFS/LS Application. Doing that solved the problem! Now to get Lync working through or around the firewall!

Where can I find that? Is it within the IIS settings for the ADFS site?

@EduTech

[EduTech]

Open IIS > Select Your Default Web Site > ADFS > LS and then select Authentication > Click on Windows Authentication > Select Providers from the right hand-side > Remove Negotiate.

 

Regards,

James.

[themightymrp]

Late to the party I know but as an interesting addition to this topic, I have the extended protection enabled on the IIS server and the only problem I was having with regards SSO was when using Firefox. It would still prompt for a logon when attempting to access the email. To solve this while still leaving the protection on I did this:

 

In firefox, type in the URL of about:config

 

Do a search for "network.automatic-ntlm-auth.trusted.uris" , then add the url of the adfs server to the string i.e. adfs.school.sch.uk

 

Closed Firefox and re-opened and SSO worked fine!

[the_dude]

not knocking adfs, but with the latest flavor of dirsync with password sync you get the same username/ password in the cloud as on premise and really it is a much simpler design. We just switched from adfs.

[themightymrp]

True, I did look at that myself. However the powers that be wanted full SSO so that's what they got.

[themightymrp]

A bit of an old thread I know (sorry) but just sharing some additional info on the Extended Protection feature.

 

About a year ago Google Chrome stopped working with our ADFS SSO (version 2). I tried doing the above change in IIS and for some reason it stopped SSO working altogether?? Odd I know.

 

However I've just found that you can disable this feature via the registry on client machines rather than adjusting the server!

 

Open regedit and go to HKLM\System\CurrentControlSet\Control\Lsa - look for a value called SuppressExtendedProtection and set its value to 1. If it doesn't exist then create a new DWORD (32bit) value and give it that name and number.

 

Close regedit and retry through Chrome - problem solved! Just thought I'd share for anyone else having issues with SSO and Chrome.

[dbooth]

Microsoft called me back today and gave me the solution.

 

On both the ADFS server and ADFS proxy, you need to turn off the Negotiate authentication provider on the Windows authentication method for the ADFS/LS Application. Doing that solved the problem! Now to get Lync working through or around the firewall!

 

 

Hi, I think I have the exact same problem with ADSF 3.0, but try as I might I cannot find where you can turn off Negotiate Authentication Provider as you suggest in your post. Would you be able to point me in the right direction please? Many thanks.