Shibboleth and office 365 True SSO

[David Gersic]

I'm running both Shibboleth IdP and ADFS here. Shib for everything that isn't Office365.


It sounds like what you want could be described as:


User sits down at Windows workstation.

This workstation is "joined" to a local Active Directory domain.

User "logs in" to Windows workstation.

User fires up IE and goes to Office365.

User is auto-magically "logged in" and can do Office365 things.


Yes? If so, note that while this is possible, it has a few caveats. First, that you're going to be using ADFS and federating your local domain with Office365. Second, that you're going to be using IE. This ONLY works with IE, and requires that the user (or you) make some local changes on the workstation to enable it.


In the end, even though we're using ADFS, we disabled this feature, as it was more confusing than helpful, especially since most of our users are not using IE.


________________________________
From: users <users-bounces at shibboleth.net> on behalf of School Helpdesk <icthelp at tuptonhall.derbyshire.sch.uk>
Sent: Thursday, July 02, 2015 5:14 AM
To: users at shibboleth.net
Subject: Shibboleth and office 365 True SSO


Hi,



Apologies for what may sound like a silly question, however I am currently in the process of weighing up the pros/cons of ADFS and Shibboleth.



My question is can Shibboleth provide our active directory environment domain users with true seamless sign on to office 365 and in particular the outlook web app?



All the demos I have seen show the user either firstly logging into the Shibboleth captive portal then automatically into outlook web app, or the user types their email address which then redirects them for federated login. I understand that for external access this behaviour is normal, however internally we really want true SSO for our users. Does anybody know if this is indeed possible?



Thanks

Brent





Tupton Hall School
A Specialist Sports College with ICT

________________________________

t: 01246 863 127 | f: 01246 250 068 | w: www.tuptonhall.derbyshire.sch.uk<http://www.tuptonhall.derbyshire.sch.uk/>
Like us: www.facebook.com/tuptonhallschool<http://www.facebook.com/tuptonhallschool> | Tweet us: www.twitter.com/tuptonhalls<http://www.twitter.com/tuptonhalls>

________________________________

This email (together with any files transmitted with it) is intended only for the use of the individual(s) to whom it is addressed. It may contain information which is confidential and/or legally privileged. If you have received this email in error, please notify the sender by return email (or telephone) and delete the original message. The sender has taken reasonable precautions to check for viruses but the recipient opens this message at his or her own risk. To report abuse email abuse at tuptonhall.derbyshire.sch.uk<mailto:abuse at tuptonhall.derbyshire.sch.uk>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150706/82aa2006/attachment.html>