pknet

I appreciate all the help/suggestions. I finally figured out what was the problem with my program . I was trying to login to the wrong website. I had not gotten errors but I never got back the binary security code that I was expecting from Microsoft's STS. I am now able to provide seamless login from my website into Office 365.

Yes I have deployed ADFS. The accounts in AD are federated and my ADFS STS works just fine. I am now looking at coding an SSO solution to login.

I have been told that now I can get the username and password. I still do not see how I can seemlessly authenticate to office 365. I thought that SharePointOnlineCredentials might allow me but I can authenticate but I would need a little more than that to sign the person into the site. Any suggestions?

We are using Active Directory. I am not sure what you mean by access OWA using the name space. The users need/want to access their email by clicking on a link without entering in their username and password again. The users authenticated to Active Directory but I only have access to the userid of and not the password and they are not authenticated to the network. The system that collected the password is not passing the password to me and I can not get it. All I can get is an encrypted Active Directory userid. I have created other SAML and SSO applications where as a programmer I have been able to connect to the outside source as what ever user I want because there was a trust built in with the Certificate used for all users to encrypt the SAML token. Only through my program I could, users could not get around it. I built the SAML 1.1, 2.0 and passed it to the other system. I hope that this clarifies why and what I want to do.

So when you said that "It does..." did you mean that I can authenticate without the password and just username and a X.509 cert? I have read the documentation but I have not seen how do do this. I would allow them to login with a username and password but the system is a closed system that they have already authenticated to and I only have a userid. In other SSO implementations I have just used a userid and x.509 cert but this is the first time I have tried to do it with ADFS so I am a little confused. I really appreciate the help.

I have read and re-read the white paper but I am still confused about the SSO portion of it. I am looking how to authenticate a user by basically their userid. I have in the past with other SSO/SAML implementations done this by passing the userid and signing the data. I see that the in the Supported SAML that it does support X.509 Certificate. I am hoping that I can authenticate with out the userid and password and use a Certificate. [h=3]Supported SAML Authentication Context Classes[/h][TABLE=width: 918] [TR] [TH=bgcolor: #EDEDED]Authentication Method[/TH] [TH=bgcolor: #EDEDED]Authentication Context Class URI[/TH] [/TR] [TR] [TD]User Name and Password [/TD] [TD]urn:oasis:names:tc:SAML:2.0:ac:classes:Password [/TD] [/TR] [TR] [TD]Password Protected Transport [/TD] [TD]urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport [/TD] [/TR] [TR] [TD]Transport Layer Security (TLS) Client [/TD] [TD]urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient [/TD] [/TR] [TR] [TD]X.509 Certificate [/TD] [TD]urn:oasis:names:tc:SAML:2.0:ac:classes:X509 [/TD] [/TR] [TR] [TD]Integrated Windows Authentication [/TD] [TD]urn:federation:authentication:windows [/TD] [/TR] [TR] [TD]Kerberos [/TD] [TD]urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos [/TD] [/TR] [/TABLE]

Thanks for the reply! I have been told that we are using DirSync. I am currently not using the SSO toolkit and I assume we are running the 4.5 update. The webpage that I have is only authenticated on one of the Apache servers and the user clicks on a link that contains an encrypted userid/etc. Since the user is not really authenticated with a user name and password I am not sure how to implement. I have done something similar with other SSO implementations (SAML) but since I have never worked with o365 I am out of my realm. I hope that this explains it a little more.

Currently we are authenticating int Live@edu by using just a userid. The user logs into our portal with their username and password and when they click on the email link they are automatically logged in. We have security setup so that the link can not be used on other pc's etc. I want to authenticate to office 365 from my web page. I currently have Federated the userid's from our active directory over to o365. What I need to do is allow a user to login from our webpage, display a link to o365 so they can click on it to see their email. I am wondering if in order to login multiple ways to o365 can I setup a custom STS or something else to create the information so I can send to o365 to SSO into it. I will not be authenticated to ADFS 2.0 unless I can create it by just the userid. What are my options to SSO the user into o365? Thanks in advance