Azure AD

[kevin_lane]

Looking at going from password hash to password pass through authentication with single sign on

 

Just been reading up and just and seeing if other people have taken the leap

 

I know it fairly easy to enable but I’m just wanting to play caution to the wind for when I Change over

 

When you enable password through authentication with single sign on what experience did your users get and what issues if any did you get

 

Thanks

[Steve21]

If your only reason for changing is for SSO, I take it you realise you can do it just the same with hash?

 

Didn't see a reason to change to pass-thru when we did it so never had any issues etc

 

Steve

[mavhc]

"Seamless SSO can be combined with either the Password Hash Synchronization or Pass-through Authentication sign-in methods"

[kevin_lane]

Yea I know its just like password with hash but I always get a sense of something is going to go wrong when it’s been presented as something really easy to do lol Microsoft never make things easy lol

 

 

But yes I would like to make it easy for staff and pupils so when they come back and wanting to sign into 365 and other services that are tied into our platform they can just “sign in” seamlessly.

 

And when they are outside of the school they can still continue to do the same with user and pass

[Steve21]

Yep that's what hash does too That's the SSO side of things, rather than the hash

 

Both will allow you to login automatically on-site, and with same details externally

 

The only difference is that pass-thru allows more security based things like logon-hours etc (as it's constantly checking your AD server for policies), however you need to have it running a client constantly on servers for it to work. e.g. If your server goes down you have problems logging into cloud too

 

Steve

[fredbayker]

Yep that's what hash does too That's the SSO side of things, rather than the hash

 

Both will allow you to login automatically on-site, and with same details externally

 

The only difference is that pass-thru allows more security based things like logon-hours etc (as it's constantly checking your AD server for policies), however you need to have it running a client constantly on servers for it to work. e.g. If your server goes down you have problems logging into cloud too

 

Steve

 

Yup, we had this experience, so we switched over to password hash and haven’t really looked back. It does what we need it to.

[kevin_lane]

Yup, we had this experience, so we switched over to password hash and haven’t really looked back. It does what we need it to.

 

So added the clients to my DCs and tried the pass thru and enable the sso however and tried to test it made sure that the urls that needed to be on the intranet side,

 

However still unable to login also what made it worst was that when I removed the password password hash my users couldn’t login however some users could login e.g my user account could login could of been a cache issue but

There is a log file on whatever server the client uses to pass the authentication through and i got an error about authentication failed,

 

I will find the error when back on Monday or if I get chance to vpn on

 

So I turned back on password hash and changed it back to pass hash authentication

 

 

And everything went back working which was nice lol

[fredbayker]

So added the clients to my DCs and tried the pass thru and enable the sso however and tried to test it made sure that the urls that needed to be on the intranet side,

 

However still unable to login also what made it worst was that when I removed the password password hash my users couldn’t login however some users could login e.g my user account could login could of been a cache issue but

There is a log file on whatever server the client uses to pass the authentication through and i got an error about authentication failed,

 

I will find the error when back on Monday or if I get chance to vpn on

 

So I turned back on password hash and changed it back to pass hash authentication

 

 

And everything went back working which was nice lol

 

Lol (I have typed this extra sentence due to the minimum character limit)