Google Apps - Chrome Single Sign On

[googlemad]

Got Google Apps Directory Sync working well and just the password sync to implement over the summer (as everyone will have to reset their password initially for that to work), how can we then configure it so when a user signs in to a PC with their AD account that if they open Google Chrome they are automatically signed in to it as their Google account so that their history etc is saved for roaming around?

 

Hoping this is possible as the current way of storing their data in roaming profiles is getting out of hand and I would like to exterminate all staff roaming profiles this summer!

[mowgli82]

Sorry to hijack this, why do you need GAPS if you already have GADS installed and configured. Have I missed something????

[Valyyn]

You need GAPS as GADS cannot sync passwords from Active Directory:

http://i.imgur.com/5QNBAIGm.png

 

Edit: And I have no answer for the original question, but would be very interested in an answer too

Edited June 1, 2015 by Valyyn

[mowgli82]

I wasn't aware of that, I thought GADS did the whole lot. I was planning to roll out GADS over the summer hols. I better look at getting GAPS setup as well. :o/

[Valyyn]

To be fair GAPS isn't too bad. It's basically just a service that runs and intercepts password change requests and duplicates them to the Google account.

 

Important things to remember are:

 

* It needs to be installed and running on every DC (I only did one of our DCs first time, and everyone who'd authenticated against the second didn't have their Google password changed)

* It cannot read current, encrypted passwords, it can only read password changes. So once it was up and running, we set everyone's accounts to require a password change at next logon.

[mjk]

Is there any way of doing it the other way around; ie signing into windows, using Google as the authentication source and missing out AD?

[mowgli82]

If I bulk reset everyone's password in AD would that work or is there a reason why they have to do it themselves? I am in a primary school so would rather not get the kids to change it themselves.

[rickjames]

To be fair GAPS isn't too bad. It's basically just a service that runs and intercepts password change requests and duplicates them to the Google account.

 

Important things to remember are:

 

* It needs to be installed and running on every DC (I only did one of our DCs first time, and everyone who'd authenticated against the second didn't have their Google password changed)

* It cannot read current, encrypted passwords, it can only read password changes. So once it was up and running, we set everyone's accounts to require a password change at next logon.

 

Is there any documentation proving this? Also do you need both GADS and GAPS on both?

[Valyyn]

If I bulk reset everyone's password in AD would that work or is there a reason why they have to do it themselves? I am in a primary school so would rather not get the kids to change it themselves.

 

Nope you can do that perfectly fine, as long as the password changes, it doesn't matter whether they do it through Windows or you do it through Active Directory Users & Computers

[Valyyn]

Is there any documentation proving this?

 

Sure:

https://support.google.com/a/answer/2622457?hl=en

Make sure you have installed GAPS successfully on all of your domain's Active Directory servers (Domain Controllers).

 

 

Also do you need both GADS and GAPS on both?

Nope - GADS is a manually run tool to synchronise the actual accounts, so only needs to be run on one DC - it basically gets a list of the users and exports it to Google (to create new ones, lock disabled ones etc)*.

 

GAPS is an always running service which has to intercept password change requests and so does need to be on both.

 

(*There may be a a way to make it automatically run, but I've not tried to be honest - I just click sync when I add a new user).

Edited June 1, 2015 by Valyyn

[mrhcarlin]

Nope you can do that perfectly fine, as long as the password changes, it doesn't matter whether they do it through Windows or you do it through Active Directory Users & Computers

 

I haven't found this to work actually. If a user's password is reset using AD, GAPS does not seem to intercept this change. So when the user logs in using their newly reset password, their Google password will still be their old password. However, if they then reset it manually, it works fine.

 

Maybe you or someone else can shed some light on this in case it is not expected behaviour.

[LukeC]

I also found it problematic so I now have Google apps syncing with our Azure Ad no issues here so far. if you use office 365 as well here is the guide https://msdn.microsoft.com/en-us/library/azure/dn308591.aspx

[mjk]

Maybe you or someone else can shed some light on this in case it is not expected behaviour.

 

We can change passwords with AD>users+Computers or users can do it manually, either seem to work.

Are you sure the issue isn't that you set "user must change password on next login"?

[mrhcarlin]

Are you sure the issue isn't that you set "user must change password on next login"?

 

I'm pretty sure

[Valyyn]

I haven't found this to work actually. If a user's password is reset using AD, GAPS does not seem to intercept this change.

Maybe you or someone else can shed some light on this in case it is not expected behaviour.

 

Ah yeah, definitely not expected behaviour - I added our admin team on to Google at the start of the week and to save them all changing their passwords, I visited each one individually and had them "change" their passwords to the same thing through AD U+C right click -> Reset password. As mjk says, I believe having "user must change password on next login" ticked does break it (although it will update when they do log in and change it).

 

Edit: Just saw your post about the tick box, so ignore that part! Do you have more than one DC? When we first did it, we have two DCs which share the load of being the "logon server" and I'd only installed the GAPS service on one of them. Everyone who was assigned the other DC didn't get their Google passwords changed. There's a really good troubleshooting tool you can use to look at the logs. Do you know about it, or do you want me to double-check where I got it from?

 

Edit again: I'll add instructions anyway actually, as it may help someone even if you already know it

 

Download the GAPS Support tool from: https://github.com/google/gaps-support-tool/blob/master/gapstool.exe

Copy it to the desktop of one of your DCs and run it.

When it finishes, close it and you should have a zip file on your desktop named something like "GAPSTool-report_20150605_151144.zip"

Extract all and open it

In there should be a folder for each of your DCs.

Pick one to start with (ideally the one you're on) and go into it, then the Service2008 folder.

There are your log files, with the newest at the bottom.

You can see every password change request there, including any errors.

If none, check the folder for your other DC too.

Edited June 5, 2015 by Valyyn

[mrhcarlin]

Yeah the tool sounds like it could be good. I was aware of the 'all DCs' requirement and do have the service running on all of ours.

[Valyyn]

Fingers crossed it will be of some help

[mrhcarlin]

Thank you kindly I'll have a snoop!