Google Apps - Directory Sync & ADFS

[FN-GM]

Hello,

 

I want to setup Google Apps so we have SSO. Is it similar to Office 365 where we setup Directory Sync and then setup ADFS? What I am asking is we have to setup both, not just ADFS on its own?

 

Thanks

Edited November 10, 2015 by elsiegee40

[skell]

Very similar - we run both here.

 

Google uses GADS and GAPS for AD sync and password sync respectively.

 

You can use the existing ADFS server and just add a relaying party trust to it. Works really well, but SSO doesn't work for Youtube, which is a bit of a bummer.

[FN-GM]

Do you know if SSO works for Google Chome sign in please?

 

Thanks

[skell]

Do you mean in the browser or on a Chromebook?

 

Browser, EDIT: Sort of, Chromebook, yes.

Edited November 9, 2015 by skell

[FN-GM]

I mean the Chrome browser on Windows

[CyberNerd]

. Works really well, but SSO doesn't work for Youtube, which is a bit of a bummer.

 

It does if you sign into the browser - it's how we get teachers to whitelist video for the domain.

 

- - - Updated - - -

 

I mean the Chrome browser on Windows

 

Yes it does work. Once people are signed in you can deploy apps to them too - a really neat way of getting applications and links onto their home computers

[FN-GM]

Yes it does work. Once people are signed in you can deploy apps to them too - a really neat way of getting applications and links onto their home computers

 

Brill!

 

I need a way to save bookmarks in Chrome between computers this is the only way I can think of. Plus I am looking at Chromebooks so will make life easy.

[FN-GM]

When I do the first google apps sync, its not going to send an email to the users it has uploaded or anything will it? I don't want them to know its happening yet until im ready

 

Thanks

[CyberNerd]

no I don't think so. Also be aware that it doesn't unencrypted your current AD passwords, it only syncs new passwords as they are changed in AD.

[FN-GM]

no I don't think so. Also be aware that it doesn't unencrypted your current AD passwords, it only syncs new passwords as they are changed in AD.

 

That's fine, we will be using ADFS anyway. Is there a way to set it not to sync the actual AD password at all?

 

Thanks

[CyberNerd]

That's fine, we will be using ADFS anyway. Is there a way to set it not to sync the actual AD password at all?

 

Thanks

 

Just don't install GAPS.

[FN-GM]

Just don't install GAPS.

 

Oh is it a separate thing? I have just put on the directory sync but it still has the attached settings? Thanks

[CyberNerd]

Oh is it a separate thing? I have just put on the directory sync but it still has the attached settings? Thanks

 

Yes GAPS will sync password changes to GAFE as they happen. I think you can leave the settings as they are.

[FN-GM]

Thanks.

 

One last question, do you have any good setup guides to get it setup with ADFS 3.0 please? I can only find guides that relate to ADFS 2.0

 

Thanks

[skell]

We're using ADFS 3, but this guide works. The windows just look a bit different.

 

Setting up Google Apps Single Sign On (SSO) with ADFS 2.0 and a custom STS such as IdentityServer » Sam Huggill's Weblog

 

Make sure put the certs in the right place. You can use the ADFS Token Signing cert for both.

[FN-GM]

That guide didn't work. I re did it all again twice and no change.

 

I used this one and it worked first time - Google Apps and Active Directory Federation Services | IT Link Maine

[FN-GM]

Does anyone know if it is possible to exclude a handful of users from the Org units sync please?

@CyberNerd How do you get chrome to sing in automatically please?

 

Thanks

Edited November 10, 2015 by FN-GM

[CyberNerd]

Does anyone know if it is possible to exclude a handful of users from the Org units sync please?

@CyberNerd How do you get chrome to sing in automatically please?

 

Thanks

 

We exclude users in sub-orgs.

I think we may have been talking cross purpose about SSO. The browser users the same credentials (single username and password), but does not use pass through authentication. Once signed in for a particular session, windows will remember it.

[bigal06]

Does anyone know of the 'Smart Links' or how to generate them for Google SSO. I mean, if I send a user to mail.google.com/a/domainname then it redirects to ADFS (on site) and auto logs the user in then sends them to back to Gmail? I want to send them just to the Google search page or maybe the G Suite home page not just gmail.

 

I already do this on office 365 and land them on the Office 365 portal page automatically. https://adfs.domain.co.uk/adfs/ls/?lc=2057&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline works really well but how about google?

[FN-GM]

I mean, if I send a user to mail.google.com/a/domainname then it redirects to ADFS (on site) and auto logs the user in then sends them to back to Gmail?

 

It will

 

You can also use drive.google.com/a/doamain.com, classroom.google.com/a/doamain.com etc