We are migrating from Live@edu to Office 365 and I need to SSO it like it is for LIVE

[pknet]

Currently we are authenticating int Live@edu by using just a userid. The user logs into our portal with their username and password and when they click on the email link they are automatically logged in. We have security setup so that the link can not be used on other pc's etc.

 

I want to authenticate to office 365 from my web page.

 

I currently have Federated the userid's from our active directory over to o365. What I need to do is allow a user to login from our webpage, display a link to o365 so they can click on it to see their email.

 

 

I am wondering if in order to login multiple ways to o365 can I setup a custom STS or something else to create the information so I can send to o365 to SSO into it.

 

 

I will not be authenticated to ADFS 2.0 unless I can create it by just the userid.

 

What are my options to SSO the user into o365?

 

Thanks in advance

 

[EduTech]

Hi,

 

I hope I am understanding you correctly here, had a few beers! :-) in regards to the URL that you want to be using to place on your website you would need to use http://mail.office365.com or http://outlook.com/federateddomain.com

 

In regards to SSO if you are currently using ILM & PCNS you'll need to make plans to upgrade to DirSync. If you're using the SSO toolkit you'll need to make sure you're running the 4.5 update, and prepare longer term for ADFS / Shibboleth. More information about this can be found in the following Whitepapers

 

Download Office 365 Single Sign-On with AD FS 2.0 whitepaper from Official Microsoft Download Center

 

Download Office 365 Single Sign-On with Shibboleth 2 whitepaper from Official Microsoft Download Center

 

You are only able to provide SSO Services to Office 365 using ADFS or Shibboleth.

 

I hope that helps,

 

Regards,

James.

[pknet]

Thanks for the reply!

 

I have been told that we are using DirSync. I am currently not using the SSO toolkit and I assume we are running the 4.5 update.

 

The webpage that I have is only authenticated on one of the Apache servers and the user clicks on a link that contains an encrypted userid/etc.

 

Since the user is not really authenticated with a user name and password I am not sure how to implement. I have done something similar with other SSO implementations (SAML) but since I have never worked with o365 I am out of my realm.

 

I hope that this explains it a little more.

[sukh]

Only ADFS or Shibboleth, nothing else is supported I'm afraid.

SAML is what ADFD 2.0 is based on for O365. It can be fairly simple, you just need to make sure you follow the whitepaper above.

 

Do you have any specific questions?

Edited May 18, 2013 by sukh

[pknet]

I have read and re-read the white paper but I am still confused about the SSO portion of it.

 

I am looking how to authenticate a user by basically their userid. I have in the past with other SSO/SAML implementations done this by passing the userid and signing the data.

 

I see that the in the Supported SAML that it does support X.509 Certificate. I am hoping that I can authenticate with out the userid and password and use a Certificate.

 

[h=3]Supported SAML Authentication Context Classes[/h][TABLE=width: 918]

[TR]

[TH=bgcolor: #EDEDED]Authentication Method[/TH]

[TH=bgcolor: #EDEDED]Authentication Context Class URI[/TH]

[/TR]

[TR]

[TD]User Name and Password

[/TD]

[TD]urn:oasis:names:tc:SAML:2.0:ac:classes:Password

[/TD]

[/TR]

[TR]

[TD]Password Protected Transport

[/TD]

[TD]urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

[/TD]

[/TR]

[TR]

[TD]Transport Layer Security (TLS) Client

[/TD]

[TD]urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient

[/TD]

[/TR]

[TR]

[TD]X.509 Certificate

[/TD]

[TD]urn:oasis:names:tc:SAML:2.0:ac:classes:X509

[/TD]

[/TR]

[TR]

[TD]Integrated Windows Authentication

[/TD]

[TD]urn:federation:authentication:windows

[/TD]

[/TR]

[TR]

[TD]Kerberos

[/TD]

[TD]urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos

[/TD]

[/TR]

[/TABLE]

[sukh]

It does but O365 uses User ID and password (UPN) with an option for 2FA.

 

I'm not sure why you don't want to use ADFS and allow users to connect natively using the URL for Web services.

[pknet]

So when you said that "It does..." did you mean that I can authenticate without the password and just username and a X.509 cert? I have read the documentation but I have not seen how do do this.

 

I would allow them to login with a username and password but the system is a closed system that they have already authenticated to and I only have a userid. In other SSO implementations I have just used a userid and x.509 cert but this is the first time I have tried to do it with ADFS so I am a little confused.

 

I really appreciate the help.

[sukh]

no I mean does authenticate with username and password using exit credentials. Not sure how you are trying to do this but what type of a directory do you have? AD DS?

 

Why don't you want the use to access OWA using the name space?

[pknet]

We are using Active Directory. I am not sure what you mean by access OWA using the name space. The users need/want to access their email by clicking on a link without entering in their username and password again. The users authenticated to Active Directory but I only have access to the userid of and not the password and they are not authenticated to the network. The system that collected the password is not passing the password to me and I can not get it. All I can get is an encrypted Active Directory userid.

 

I have created other SAML and SSO applications where as a programmer I have been able to connect to the outside source as what ever user I want because there was a trust built in with the Certificate used for all users to encrypt the SAML token. Only through my program I could, users could not get around it. I built the SAML 1.1, 2.0 and passed it to the other system.

 

I hope that this clarifies why and what I want to do.

[EduTech]

Ok, so you are saying that the users authenticate against Active Directory but are you saying that the machines are maybe not domain joined and so therefore when they click on a link you want them to be able to not have to enter the username and password... if the users are domain joined then this is going to be a bit complicated. BUT if the domains are members of the domain and the users logs in then in order to get what you want you need to deploy ADFS.

 

You don't need to have to see the Password because ADFS would pass through this information hence SSO and it would also use the users UPN.

 

That's if I am understanding you correctly, there is no supported way to do what you want unless you have AD FS to pass through the information to Office 365 automatically.

 

Regards,

James.

[sukh]

I agree with James here. What needs to be clarified is the link that users click on. Is this on a system/webpage internally connected to AD? And the users are they using domain joined pc or not? If not they will be prompted.

As for using certs, that's not supported with O365. So in short domain joined pc which users use to connect to owa will honour SSO, even if not connected to network (cached credentials). Hope that makes sense.

[pknet]

I have been told that now I can get the username and password. I still do not see how I can seemlessly authenticate to office 365. I thought that SharePointOnlineCredentials might allow me but I can authenticate but I would need a little more than that to sign the person into the site. Any suggestions?

[EduTech]

If you want to seamlessly authenticate to Office 365 then you will need to implement an Active Directory Federation Services Solution, This with Domain Joined Computers will provide a seamless authentication experience.

 

Regards,

James.

[mattysmith80]

If you want to seamlessly authenticate to Office 365 then you will need to implement an Active Directory Federation Services Solution, This with Domain Joined Computers will provide a seamless authentication experience.

 

Regards,

James.

 

Plus 1 here for ADFS

[sukh]

Pretty much said above. Hqve you deployed ADFS ?

[pknet]

Yes I have deployed ADFS. The accounts in AD are federated and my ADFS STS works just fine. I am now looking at coding an SSO solution to login.

[sukh]

You don't need to code a solution, this is what ADFS does.

[EduTech]

If you have deployed AD FS then you will have your own AD FS login Page. You will be able to view this at the URL for AD FS that you have chosen.

 

If you require more information on this then please see here:

 

Customizing the AD FS 2.0 Sign-in Web Pages - Claims-Based Identity Blog - Site Home - MSDN Blogs

 

Customize ADFS 2.0 Login page with a logo | Laurent Bel's blogging

 

AD FS 2.0 Sign-In Pages Customization Overview

 

Kindest Regards,

James.

[pknet]

I appreciate all the help/suggestions. I finally figured out what was the problem with my program . I was trying to login to the wrong website. I had not gotten errors but I never got back the binary security code that I was expecting from Microsoft's STS. I am now able to provide seamless login from my website into Office 365.