Adobe Cloud CC Single Sign On with Shared Device Licenses

[PCope]

I work in the I.T. Support dept of secondary school with 800+ students.

 

Adobe have made using their product more difficult to access for schools and establishments by introducing SDL (Shared Device Licensing) and this has been out for alittle while now. What this means is that whilst the software is licensed to a device, End users are still required to manually authenticate with an ID whereas before under the Device License model, all end users had to do is open the software and use it which is how it should be in a teaching and learning environment. The idea of SSO (Single Sign On) is that you login once and that any relevant sub systems/software are aware of that and won’t bother you for credentials. I’m giving my full perspective here and not meaning or intending to teach anyone to suck eggs as there are a lot of respectful technical minds here on edugeek.

 

So what have I done so far?... I’ve configured and synchronised our Azure Active Directory users as Federated IDs which now exist in our Adobe Cloud agreement – pretty easy. I’ve looked at the profile and general settings – pretty easy. I’ve created and downloaded packages for OSX and Windows environments and done good few mac deployments using ARD (Apple Remote Desktop). I’ve logged into the software manually with some test accounts.

 

Now this is the crux of it and a lot of people seem to be in the same boat. I’ve not found “anything” solid that gives instruction on direction with regard to configuring SSO in our environment (Particularly around Apple Macs which is where we mainly use Adobe Apps for our lesson delivery in photography). I want students to be able to sign into a station, and then the adobe authentication happens automatically when they open the software – not a big ask.

 

I’ve read a lot of bits and pieces about SAML 2.0, IDPs, Certificates but there is nothing solid. I’ve contacted Adobe support and they clearly state that they don’t have a solution and it’s something that isn’t supported but, they are very insistent that the new licensing model is much better. Well, it just isn’t for schools. Sure if I’m personally using the software then it doesn’t bother me too much but expecting each class of 30 students to type in their full email address and password eats away at their precious learning time and some do struggle more than others.

Any thoughts, advice, feedback or shared experiences would be much appreciated.

 

Many Thanks,

Adrian Richards

[Asgard]

Hi Adrian

We are in a similar boat to you, we are a Sixth Form College just shy of 2000 users.

 

I was on an Adobe webinar late last month with their educational specialists and JISC looking at the roadmap and discussing Covid-19. I’ve tried to anonymise who I am ha

 

Before I go down the rabbit hole....

 

Some of you may be using the free extension they gave to let staff/students use Adobe CC from home during the current pandemic. This is being removed by Adobe on the 6th July.

 

Also they said that running CC in a VDI environment is not supported (or allowed). This didn’t go down well.

 

A little bit of a “heated” discussion from a few huge universities about it stating how good Microsoft are with their licensing and it was basically “you can’t compare apples”. But they did take onboard that some places are playing many 10’s of thousands on software that can’t be used because they don’t allow it on VDI or any form of connecting into a local desktop.

 

Now it’s down the rabbit hole !

 

I have been discussing their implementation of SSO , or lack of , with them for a while.

 

I raised it with the enterprise support team

 

But to summarise my call to them

 

“

All of our users are federated.

 

The issue we have is that each time a user roams to another machine they have to re-login to Adobe CC. Is the registration / activation stored in the registry which would allow us to export it / import on login as we can see that it’s not true SSO.

 

The frustration for the users is that each time they login, they are asked to re-login to Adobe Creative Cloud. Alternatively is there no true SSO as we are already federated via AzureAD.

 

Effectively a user could roam on upto 5 devices a day and if they don’t have a cached profile on the machine (we delete after a week) then they have to open Adobe CC and login before they can proceed – it causes further issues when people open PDFs directly from within Outlook / web, so we have had to force a change to make Chromium Edge the default reader for PDFs.

 

Worse still, you cant save a PDF in Word unless you have first opened Adobe Acrobat or use the inbuilt Microsoft Save As PdF (not the Save As Adobe PdF).

 

We use a number of Shared Device License/MultiUser licenses that are linked to our Azure SSO / ADFS and they seamlessly authenticate.

 

Really my query boils down to making the opening of AdobeCC less intrusive/obstructive.

“

 

The reply was disappointing, essentially they said it’s by design. When you login it stores the authorisation into the local credentials manager.

 

But they said that it could be a change in the future that it could work seamlessly. To be honest I’m not holding out hope for easy 12 months. So we’re stuck with giving users workarounds because the software/implementation is flawed.

 

The webinar was actually pretty good and all the people from Adobe/JISC especially Howard Moody do listen and Howard especially tries to push adobe for education.

 

They are going to look into Adobe licensing on VDI etc even if short term because of the pandemic.

 

But yeah Adobe CC 2020 and their “SSO” makes me sad.

Edited June 5, 2020 by Asgard

[dhicks]

software that can’t be used because they don’t allow it on VDI or any form of connecting into a local desktop.

 

Ah - I'd missed that bit. I've been sizing up remote desktop hardware to potentially run Photoshop for if we needed it when we start our senior school curriculum (we're currently a prep school, starting to expand up to Year 11 from September). Running as a remote solution would be perfect - pupil opens a web browser, logs in to the Windows remote desktop with their Google login, runs Photoshop (or even Premier if we buy capable enough server-side hardware). They could do that from school or from home, and in a nice managed environment where we can back up their files and all that kind of thing. A cheap Chromebook (£300) is all they'd need to have to run it, too, no expensive (£800) Windows / Mac to deal with.

[Asgard]

Ah - I'd missed that bit. I've been sizing up remote desktop hardware to potentially run Photoshop for if we needed it when we start our senior school curriculum (we're currently a prep school, starting to expand up to Year 11 from September). Running as a remote solution would be perfect - pupil opens a web browser, logs in to the Windows remote desktop with their Google login, runs Photoshop (or even Premier if we buy capable enough server-side hardware). They could do that from school or from home, and in a nice managed environment where we can back up their files and all that kind of thing. A cheap Chromebook (£300) is all they'd need to have to run it, too, no expensive (£800) Windows / Mac to deal with.

 

It’s an odd one. And it caused a fair bit of angst from some of the larger institutions.

 

Previous to moving to Adobe CC2020 we used it on VDI.

 

“

https://helpx.adobe.com/enterprise/using/creative-cloud-deployment-on-vdi.html

 

Adobe’s Creative Cloud for enterprise, Individual, or Single App Terms of Use permit the deployment of its Apps in Virtual Desktop Infrastructure on cloud environments in an AS-IS model with no support of guarantee software performance or stability.

“

 

They pulled it for Shared Device Licensing

 

It went down like a lead balloon when I told them SDL doesn’t allow it;

 

https://helpx.adobe.com/uk/enterprise/using/sdl-deployment-guide.html#Frequentlyaskedquestions

 

 

Can I install shared device license packages on a virtual machine?

No. Shared device license packages cannot be installed on virtual machines.

 

Relevant to this topic;

 

Does Shared Device Licensing offer passthrough authentication?

No. Currently, Adobe's SSO setup doesn't support passthrough authentication. Even if you have set up Federated identity, students have to sign in to the machine and then re-enter their credentials when signing in to Creative Cloud.

[PCope]

Hi Asgard,

 

Thank you for your feed back and taking the time to reply. Sounds like you’ve had a real time of it as well. Interesting point and impact regarding opening the PDFs, I could see that being a problem for us as well. It seems that Adobe have failed to provide a solution to a problem that they have created and to add insult they’ve falsely labelled it as SSO. Maybe they should call it “Adobe Single Sign On x2” (ASSOx2). We’re going to have to swallow this like yourselves and many other sites but I’m going to be sending in my feed back to Adobe. I just hope that they will get something sorted (who knows when) as actually, the software suite its self is awesome and it would be in their interest to get this right for use in education. These relating articles might be of interest to yourself or anyone although you may have seen them already...

 

http://www.edugeek.net/forums/general-chat/204493-adobe-cc-automatic-sign.html

 

https://community.adobe.com/t5/enterprise-teams/federated-id-how-can-we-tell-acrobat-dc-to-sign-users-in-automatically-sso/td-p/10248927?page=1

 

https://soundmacguy.wordpress.com/2019/02/01/adobe-shared-device-licensing-answers-to-questions-you-probably-didnt-want-to-ask/

 

Thanks,

Adrian

[Asgard]

Hi

I’ve had some productive conversations over the last two days with a member of their customer success / JISC team.

 

Also one of the links posted above included a comment from Alister Black from Adobe who has also been included and a good conversation ensued.

 

They asked for an example of a external system we use that does exactly what we all want.

 

So I sent them this;

 

For example we use a cloud based HR system called PeopleHR

 

It directly ties into our AzureAD / ADFS.

 

https://www.peoplehr.com/includes/educate/Steps_taken_to_implement_ADFS.pdf

 

We currently use the ADFS method but will be transitioning to the azure method below

 

https://help.peoplehr.com/en/articles/1020117-configure-sso-microsoft-azure-ad

 

They do acknowledge that making it less intrusive is best for everyone so are defiantly willing to entertain looking at it.

[free780]

With the SSO issue. I found users could just enter the domain and it would login.

 

Adobe do recommended Teradici for remote access but it's expensive.

 

It does feel.lile a conspiracy to get education to buy 1:1 devices for students (somehow).

 

Shared devices seem to be an after thought. How long has it taken MS to get Office 365 Pro Plus right?

[dhicks]

Adobe’s Creative Cloud for enterprise, Individual, or Single App Terms of Use permit the deployment of its Apps in Virtual Desktop Infrastructure on cloud environments in an AS-IS model with no support of guarantee software performance or stability.

 

Ah - so we can deploy per-user licensed copies of Creative Cloud, we'd just need a solution which provided each user with their own virtual Windows instance?

[free780]

1:1 scenario not simultaneously shared devices/servers.

 

So RDP with RemoteFX or Teradici from

PCs through a gateway with MFA.

Both will cost in licensing per user.

 

No idea what a RDS CAL (guessing you have to licence all users not just max concurrent users is but Teradici were asking $140 per concurrent user per year.

 

Labstats have also done a RDP front end that let's you somehow book a user into a PC.

Edited June 14, 2020 by free780

[Asgard]

Ah - so we can deploy per-user licensed copies of Creative Cloud, we'd just need a solution which provided each user with their own virtual Windows instance?

 

That’s what I queried as there is conflicting information about it. Basically what they are saying is if you used named/serialised version it could be run on VDI but they offer zero support.

 

If however your on Shared Device Licensing then it’s an absolute no and they referred me to the link I posted

 

https://helpx.adobe.com/uk/enterprise/using/sdl-faq.html

 

 

Can I install shared device license packages on a virtual machine?

 

No. Shared device license packages cannot be installed on virtual machines.

[dhicks]

So RDP with RemoteFX or Teradici from

 

RemoteFX is no longer supported for new installations from Server 2019, so we've had to look at other solutions. Nutanix looks pretty good - a remote-access server, logins via various methods including OAuth if wanted, seems to have the graphical performance to run graphics/video editing applications (i.e. Creative Cloud). Cost (per year, over 3 to 5 years) for on-site hardware capable of hosting 50 simultanious logins is around £18,000, which includes licensing for Nutanix itself and hardware. That doesn't include Windows RDS user CALs, which we pay for as part of our Microsoft license agreement, or, of course, licensing for Crearive Cloud itself (around £3,000 for our school of around 400 pupils, last time I checked).

 

I'm hoping to avoid the need to run Creative Cloud in the first place - there are very good options available for web-based audio and video editing, both together costing under £1,000 a year, and I can sort out an OAuth-authorised gateway for Windows remote desktop using Guacamole which should be fine for non graphics-intensive applications - even Photoshop should be fine, just not video applications.