Google Chrome Auto Sign-in

[Janx1975]

Hi,

 

We are a GAFE school and recently moved away from RM to Vanilla, but one of the things I am unable to get my head around at the moment is getting Staff and Students to automatically sign into their Google accounts.

 

The Google password sync is working ok, so password changes in AD apply to google email password.

 

I had a brief foray into researching this but, from what I can see, the hoops I would have to jump through would only work on Chrome devices and not Windows 10 desktops etc anyway.

 

As Staff and Students here have their homepages set to our internal sites.google.com/*user*-internal pages, they are being asked (rightly) to login (which is causing issues when they choose not to).

Previously on the RM system, both staff and students just got their respective homepage without having to manually sign in, so there must be a way or a plugin I am not aware of.

 

Would anyone have any clues, pointers or, even better, - a guide on how to achieve this?

 

As we went Vanilla to save on support costs with RM, we are loathe to have to pay for a third party tool to do this...

 

Many thanks in advance

[dmj]

It is possible to do SSO with windows /gsuite, but you would need to link your GSuite accounts to a single sign on mechanism such as ADFS (this works on Chromebooks too). I've not found another way to do it, or how to do this with macos/linux clients*. - but would be interested to hear if anyone else has experience. If you go down the saml/ADFS route it means you would have to use Active Directory as your only password store, so you don't get some of the advantages of storing passwords in Google (such as LDAP) and have another point of failure - so it is certainly not a panacea.

Once users authenticate to windows the credentials are passed through to ADFS which then automatically logs you into GSuite.

 

as a pointer see:

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-browser-wia

* edit: this may solve the mac issue using shibboleth https://wiki.shibboleth.net/confluence/display/IDP30/SPNEGOAuthnConfiguration - I am not sure.

Another option would be for you to store the browser cache in a roaming profile so that users only need to login once.

Edited June 12, 2019 by dmj

[dmj]

oh - I should also mention that you can force chrome sign in using the ADMX policies in AD but it's not automated.