Google Apps SSO with AD

[IT_Man_Dan]

Afternoon all,

 

I've had Google apps setup for a while now and have GADS and GAPS configured so that provisioning users etc is automatic from AD (although I need to give GAPS some tlc).

 

I've been asked by a number of staff if it's possible to setup single sign on so that when they or students login to Windows on site (AD) it automatically logs them into google apps and Chrome.

 

I've been reading how to do this and have come across the following guidance

http://www.huggill.com/2012/01/12/setting-up-google-apps-single-sign-on-sso-with-adfs-2-0-and-a-custom-sts-such-as-identityserver/ which looks like it might be what I need to do.

 

My questions are:

1. Has anyone here done this?

2. If so how was it achieved?

3. What problems were encountered?

 

I'll be grateful for any assistance. I've read posts online that suggest it may be a bad idea because if SSO fails noone can login to the AD domain or Google services, the thought of that is scary so I'm keen to ensure things are done correctly.

 

Many thanks

Edited June 17, 2015 by IT_Man_Dan

[mjk]

I want to do something similar , so hope it isn't a hijac. I want to have windows computers authenticate to Google apps instead of active directory. We don't really need the AD any more and it would be more simple to have a single authentication source.

[GeekyPete]

I want to do something similar , so hope it isn't a hijac. I want to have windows computers authenticate to Google apps instead of active directory. We don't really need the AD any more and it would be more simple to have a single authentication source.

 

Until your internet goes down...

 

I've heard it can be done via a google server on site though. Never seen it set up in real life.

Edited June 17, 2015 by GeekyPete

[dastrix]

I did exactly what you want to do and in the end turned it off, main reason was we had a power cut which we get a lot of due to being in a heavy industrial area. This means that when the power does go off any users offsite wont get be able to login.

 

I was going to revisit it again with Azure, hence it wouldn't cause an issue when we have a powercut.