ADFS 3.0 - No SSO For IP Range

[FN-GM]

Hi,

 

on our guest WIFI when going to the email login it is attempting to use SSO and pass the credentials of the current logged in user to ADFS. Does anyone know of a way we can turn this behaviour off for a particular IP range please?

 

Thanks

[FN-GM]

Any thoughts anyone please?

[stuartp44]

Is this via O365?

[FN-GM]

It is.

 

Thanks

[win]

Try moving the guest wifi to a completely different IP range:

 

domain 192.168.x.x

guest 10.0.x.x

 

(note - not sure if that would work, just an idea really)

[FN-GM]

That wouldn't work. Besides they are already on a different range.

[stuartp44]

What type of device is attempting the SSO? Is it a domain laptop you are testing on the guest Wifi?

[FN-GM]

Its a none domain laptop on the guest WIFI with IE only. Its fine with Chrome.

[stuartp44]

I am sure IE will only attempt SSO if the site is added to the Trusted Sites, sso is not attempted unless the site is stated in there.

[MicrodigitUK]

Its not fine if you change the ADFS server settings to support all browsers for SSO (like we do for our Apple computers and PC' using Crome).

 

Anyway, Hear is my solution. Change your DNS record to point to the ADFS proxy as it would do for off site devices.

 

Then on all of the school managed PC's or Macs add a "hosts" file record pointing direct to the ADFS server. The host file override any DNS records.

 

Thefor all school managed devices get the "hosts" file and can SSO with ADFS but all other devices get the web form login.

 

my host file has: 10.4.208.85 adfs.*********.****.sch.uk

my DNS record has: 10.4.208.86 adfs.*********.****.sch.uk

 

On windows you will finde the file in: C:\Windows\System32\drivers\etc\hosts

The host file can be deployed with GPO\GPP

Edited March 17, 2015 by MicrodigitUK