Office 365 SSO on Chromebooks?

[LRSFC_DanJ]

We're evaluating the possibility of using Chromebooks in areas of the college where users only need a cheap, low powered device to do typing and Internet research.

 

We already have Office 365 for Education, so I've managed to get Azure AD federated with Google Apps for Education, and I can now log in to our test Chromebook using an AD username and password.

 

We've used the Google management tools to push out the Office 365 extensions for Chrome to the Chromebook, but the next hurdle is making it so the SSO works on that as well.

 

When a user clicks on the Office icon currently, they are prompted to log in again with their Office 365 credentials. How do we make it so this just uses the SSO login they already logged in with?

 

The same for OneDrive for Business - we'd like this to automatically be available using the SSO login.

 

I tried searching this forum but couldn't find results that would be specific to this particular issue.

 

Thanks,

Dan Jackson (Lead ITServices Technician).

Long Road Sixth Form College

Cambridge, UK.

Edited April 26, 2017 by LRSFC_DanJ

[FN-GM]

We have it setup. We use ADFS with office 365 and gmail.

 

Then we set this setting:

 

Admin Console > Device Management > Chrome Management (on the left hand side) > User Settings > Single Sign-On

 

Admin Console > Device Management > Chrome Management (on the left hand side) > Device Settings > Single Sign-On Cookie Behavior > Enable

 

When they login they sign in via the ADFS login an then get SSO for any ADFS Service.

[LRSFC_DanJ]

Admin Console > Device Management > Chrome Management (on the left hand side) > User Settings > Single Sign-On

Admin Console > Device Management > Chrome Management (on the left hand side) > Device Settings > Single Sign-On Cookie Behavior > Enable

 

I'd set the first setting but not the second one - that's now improved the situation somewhat, but while it's now seeing the username automatically, it's still prompting for the password to be entered again.

 

We're using Azure AD as the federated identity source for Google Apps, rather than ADFS - as we already had Azure AD from our Office 365 for Education tenant.

 

EDIT: after removing the "person" from the Chromebook and then re-adding them, the situation has improved further - using the Office extension only now requires selecting OneDrive for Business from the dropdown and clicking Sign In, there's no password prompt.

 

With the Office extension for Chrome is there a way to configure it to only allow OneDrive for Business? As if users select the regular OneDrive option, it fails to let them log in.

Edited April 26, 2017 by LRSFC_DanJ

[FN-GM]

I can't answer that, we only use Exchange Online.

 

However can you use those magic links (or whatever the name is). For I created my own app to point to outlook.com/domain.com so the user clicks the icon and they are signed straight into the mailbox.

[LRSFC_DanJ]

However can you use those magic links (or whatever the name is).

 

Is it Smart Links? e.g. https://blog.kloud.com.au/2012/10/12/office-365-smart-links/

[FN-GM]

Is it Smart Links? e.g. https://blog.kloud.com.au/2012/10/12/office-365-smart-links/

 

Yeah, make a magic link and make a custom app - https://support.google.com/chrome/a/answer/2714278?hl=en

[LRSFC_DanJ]

Yeah, make a magic link and make a custom app - https://support.google.com/chrome/a/answer/2714278?hl=en

 

I've now tried to do this but the custom app has been rejected from the Chrome Web Store. Do you have a list of the steps to make a custom app for this purpose in such a way that it won't be rejected? It doesn't give a reason why it was rejected unfortunately.

[FN-GM]

I just followed that to the letter.

 

Make sure you're putting it into the private internal store not the public store.

[FN-GM]

I have never used this but might be worth a try

https://chrome.google.com/webstore/detail/chrome-app-builder/ighkikkfkalojiibipjigpccggljgdff

[Arthur]

I've now tried to do this but the custom app has been rejected from the Chrome Web Store.

I created a custom Chrome app recently for our G Suite domain and the following manifest.json file worked fine for me.

 

{
 "name": "My Custom School App",
 "short_name": "MCSA",
 "description": "Enter a description here",
 "version": "1.0.0.0",
 "manifest_version": 2,
 "icons": {
   "128": "128.png"
 },
 "app": {
   "urls": [
     "https://www.exampleschool.academy/"
   ],
   "launch": {
     "web_url": "https://www.exampleschool.academy/"
   }
 }
}

[LRSFC_DanJ]

I created a custom Chrome app recently for our G Suite domain and the following manifest.json file worked fine for me.

 

{
 "name": "My Custom School App",
 "short_name": "MCSA",
 "description": "Enter a description here",
 "version": "1.0.0.0",
 "manifest_version": 2,
 "icons": {
   "128": "128.png"
 },
 "app": {
   "urls": [
     "https://www.exampleschool.academy/"
   ],
   "launch": {
     "web_url": "https://www.exampleschool.academy/"
   }
 }
}

 

That's very similar to what I've got. However what we are trying to do is link to the various Office 365 online apps rather than our website.

 

I did select "Private" when trying to upload my Chrome app, so that is not the thing I am doing wrong.

 

Do you know what the function of the "urls" section in the manifest.json is? I get that the "launch web_url" is the URL the app actually goes to when you click it, but what's the other one? The only thing I figured out is that it has to be different for separate apps.

 

EDIT: have also tried to add it in Device Management > Chrome > App Management and I can't get this to work either, it just displays as a grey cube with the gibberish appid instead of the proper app name.

 

EDIT 2: here is the code of the manifest.json I was trying to use:

 

{
"manifest_version": 2,
"name": "Word Online",
"description": "Link to Word Online for Long Road Office 365 users",
"version": "1.0",
"icons": {
"128": "128.png"
},
"app": {
"urls": [
"https://login.microsoftonline.com/login.srf?wa=wsignin1%2E0&rver=6%2E1%2E6206%2E0&wreply=https%3A%2F%2Foffice.live.com%2Fstart%2FWord.aspx%3Fauth%3D2&whr=longroad.ac.uk"
],
"launch": {
"web_url": "https://login.microsoftonline.com/login.srf?wa=wsignin1%2E0&rver=6%2E1%2E6206%2E0&wreply=https%3A%2F%2Foffice.live.com%2Fstart%2FWord.aspx%3Fauth%3D2&whr=longroad.ac.uk"
}
},
"permissions": [
"unlimitedStorage",
"notifications"
]
}

Edited April 28, 2017 by LRSFC_DanJ

[ifarmery]

Sorry to resurrect an old thread but did you manage to get this working with regards to Word online etc being automatically authenticated? I have blindly followed the guide to create a custom Chrome extension that is then rejected by them.

 

Thank you

Ian

[LRSFC_DanJ]

Sorry to resurrect an old thread but did you manage to get this working with regards to Word online etc being automatically authenticated? I have blindly followed the guide to create a custom Chrome extension that is then rejected by them.

 

Thank you

Ian

 

Yes that is what happened to me also. I think we emailed them to explain the situation and it eventually got approved.

 

But our Chromebook project has fallen by the wayside so we are not really doing any more work on it at this time.

[ifarmery]

Thank you for getting back to me, out of curiosity how come the project failed?

 

Ian

[LRSFC_DanJ]

Thank you for getting back to me, out of curiosity how come the project failed?

 

It's not that it failed, just there wasn't really any driving factor behind it at the time we were looking at it, and priorities have shifted since then.

 

EDIT: to be clear, we didn't have a wide deployment of Chromebooks or anything, it was literally just one Chromebook we bought in to evaluate the viability of it.

Edited March 7, 2018 by LRSFC_DanJ