ADFS - Office365 & G Suite

[TSEARS]

Hi all,

 

I'm after a little help...

We have Office 365 Hybrid for email, OneDrive etc, which works great - Its using ADFS to single sign on. For this setup, say the domain this is using is domain1.com which is filled in the email field in AD.

 

We also have G Suite (Google Apps) for managing Chromebooks and restricting YouTube, which works great, but this uses domain2.com

We use G Suite Password Sync to sync passwords and Google Cloud Directory Sync to sync OUs and user accounts. This works by having the G Suite email address ([email protected]) filled in the Fax field in AD.

 

I want to get it so G Suite uses ADFS for single sign on as I know they can link, but didn't know if as it was two different domains, this would be effected.

 

If it can't use two different domains, can we add our domain1.com into G Suite without effecting Office365?

 

Any advise would be great!

 

Tom

[FN-GM]

Hi,

 

We use both Office 365 and G Suite. Use Office 365 for email and G Sutie for drive, chromebooks etc.

 

We use the same domain for both service with ADFS and works a treat. Can't see any reason to use 2 seperate domains.

 

Thanks

[TSEARS]

Thanks for that - That's what I was hoping someone would say! Don't know why it was set up with two.

 

I'm going to add the domain1.com into G Suite in the morning. Did you have to do any DNS config or all go smooth?

 

Also, do you have email enabled or can you disable it as Google Cloud Sync will ask which mail field to use in AD

 

Thanks again!

[FN-GM]

The only DNS config I did was to verify the domain. I then removed it when I was finished. I think you can use other methods like uploading a HTML to your website.

 

I disable the Gmail app on all my OU's (top level and inherit down). The sync does ask for email address. I just use the normal address used on Office 365. If it needs to send emails for whatever reason it will use this and the message ends up in Office 365.

[TSEARS]

Just hit a snag... We have 80 Chromebooks and it says changing your primary domain will effect these devices (https://support.google.com/a/answer/6301932?hl=en)

 

I'm going to contact Google today and see if there is anyway around this. If there isn't a solution, that's a bad call from Google as changing primary domain should be a supported feature when managing devices

[FN-GM]

Don't change the primary domain.

 

Our primary domain is our trust domain. Out of 3,500 users only 15 or so are on the primary domain.

[TSEARS]

Can we get ADFS single sign on working if the primary domain is not the same on G Suite?

[FN-GM]

Can we get ADFS single sign on working if the primary domain is not the same on G Suite?

 

Yep we use 4 domains on ours all with ADFS.

[TSEARS]

Thanks for all the information - Ive got it set up and working but single sign on doesn't seem to work for YouTube, is this the same for you?

Also, going to https://www.google.com/a/domain1.com takes you to the google sign in page rather the to ADFS? Do you know if that is normal behavior or should it take you to ADFS and redirect?

[FN-GM]

Youtube is a pain, it doesn't SSO. You have to press sign in and then it does it.

 

You have to use specific URLS eg

 

https://drive.google.com/a/domain.com

https://classroom.google.com/a/domain.com

[TSEARS]

ahh ok I thought that may be the case. When we go on Youtube and click sign in, it takes us to the generic google accounts login page and doesn't sign them in automatically, so the user has to put in their email address and then it signs them in without the need for password.

But i noticed if the user goes to drive.google.com/a/domain1.com it will sign them in automaticly and then when they go to Youtube after and click sign in, it signs them in without the need of the email address.

Is this the same case with your set-up?

 

Sorry for all the questions!

[FN-GM]

I think that is the case. We use drive loads here so I think vast majority of people use drive first and then youtube so it looks like SSO.

 

Its a common complaint that youtube isn't SSO.

[Compagis3]

I was looking into doing almost the same thing but just with G suite. Can you point me to an article or explain what other than ADFS? Is the https://adfs.domain.com/adfs/ls/ pointing to the server with adfs? Thanks in advance.

[TSEARS]

The link you talked about is the link you will set in G Suite to redirect the login to your ADFS server, so yes. The link is generated for you automatically on ADFS. I will find the article I used to set up G Suite with ADFS, which was really straight forward. Have you already got a ADFS server set up?

[Compagis3]

I does the SSL need to be from an cert provider or can it be from internal CA?

[TSEARS]

id recommend one from a provider, we use a wildcard certificate but normal ones are cheap as chips

[TSEARS]

Has anyones G Suite SSO from ADFS stopped working?

[FN-GM]

Has anyones G Suite SSO from ADFS stopped working?

 

Not here

[TSEARS]

Not here

 

Just finished with Google Support and they said the NameID element doesn't have a format attribute specified!

Strange, its been working fine for weeks!

[PR-UK]

Does ADFS work with the G-Suite iOS apps?

 

The help page isn't entirely clear suggesting they need to type in their full G-Suite email address but doesn't hint if that then redirects you to the ADFS Sign In page!