<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>I'm running both Shibboleth IdP and ADFS here. Shib for everything that isn't Office365.</p>
<p><br>
</p>
<p>It sounds like what you want could be described as:</p>
<p><br>
</p>
<p>User sits down at Windows workstation.</p>
<p>This workstation is "joined" to a local Active Directory domain.</p>
<p>User "logs in" to Windows workstation.</p>
<p>User fires up IE and goes to Office365.</p>
<p>User is auto-magically "logged in" and can do Office365 things.</p>
<p><br>
</p>
<p>Yes? If so, note that while this is possible, it has a few caveats. First, that you're going to be using ADFS and federating your local domain with Office365. Second, that you're going to be using IE. This ONLY works with IE, and requires that the user (or
you) make some local changes on the workstation to enable it.</p>
<p><br>
</p>
<p>In the end, even though we're using ADFS, we disabled this feature, as it was more confusing than helpful, especially since most of our users are not using IE.<br>
</p>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of School Helpdesk <icthelp@tuptonhall.derbyshire.sch.uk><br>
<b>Sent:</b> Thursday, July 02, 2015 5:14 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Shibboleth and office 365 True SSO</font>
<div> </div>
</div>
<div>
<div style="">
<p style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: "Calibri",sans-serif;">
Hi,</p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: "Calibri",sans-serif;">
</p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: "Calibri",sans-serif;">
Apologies for what may sound like a silly question, however I am currently in the process of weighing up the pros/cons of ADFS and Shibboleth.
</p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: "Calibri",sans-serif;">
</p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: "Calibri",sans-serif;">
My question is can Shibboleth provide our active directory environment domain users with true seamless sign on to office 365 and in particular the outlook web app?
</p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: "Calibri",sans-serif;">
</p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: "Calibri",sans-serif;">
All the demos I have seen show the user either firstly logging into the Shibboleth captive portal then automatically into outlook web app, or the user types their email address which then redirects them for federated login. I understand that for external access
this behaviour is normal, however internally we really want true SSO for our users. Does anybody know if this is indeed possible?</p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: "Calibri",sans-serif;">
</p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: "Calibri",sans-serif;">
Thanks</p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: "Calibri",sans-serif;">
Brent</p>
<p style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: "Calibri",sans-serif;">
</p>
</div>
<p> </p>
<p><span style="font-family:helvetica"><span style="font-size:18px"><strong><span style="color:#0f385a">Tupton Hall School</span></strong></span><br>
<span style="font-size:16px"><span style="color:#0f385a">A Specialist Sports College with ICT</span></span></span></p>
<hr>
<p><span style="font-family:helvetica; font-size:14px"><span>t:<span style="color:#0f385a"> 01246 863 127 |
</span>f:<span style="color:#0f385a"> 01246 250 068 | </span><span style="color:black">w:
<a href="http://www.tuptonhall.derbyshire.sch.uk/"><span style="color:#0f385a">www.tuptonhall.derbyshire.sch.uk</span></a> </span><br>
<span style="color:black">Like us: <a href="http://www.facebook.com/tuptonhallschool">
<span style="color:#0f385a">www.facebook.com/tuptonhallschool</span></a> | Tweet us:
<a href="http://www.twitter.com/tuptonhalls"><span style="color:#0f385a">www.twitter.com/tuptonhalls</span></a></span></span></span></p>
<hr>
<p><span style="font-family:helvetica; font-size:12px"><span style="color:#0f385a">This email (together with any files transmitted with it) is intended only for the use of the individual(s) to whom it is addressed. It may contain
<span>information which is confidential and/or legally privileged. If you have received this email in error, please notify the sender by return email (or telephone) and delete the original message. The sender has taken reasonable precautions to check for viruses
but the recipient opens this message at his or her own risk. To report abuse email
<a href="mailto:abuse@tuptonhall.derbyshire.sch.uk">abuse@tuptonhall.derbyshire.sch.uk</a>
</span></span></span></p>
</div>
</div>
</div>
</body>
</html>