All geek questions in one place

Single sign between ASP.NET application and Office365 with local ADFS STS

I am creating an ASP.NET web application that authenticates users using the Windows Identity Foundation.

The organization has a local ADFS STS. Their Office365 is authenticated through the Microsoft Federation Gateway with the local STS. The new web application will also authenticate against the local STS with WIF.

Can I set a quiet, single character between the new application and Office365? Thus, the user will not need to log in to Office365 after logging in to the web application and vice versa.

+6
source share
1 answer

Yes, you must accomplish this by combining the ASP.NET application with Office365 directly. As you probably already know, this usually works, since you have Office365 synchronized with pre-AD, and you have trust configured using an ADFS server. When you log into your web application, the user is redirected to Office365 to enter their UPN (usually an email address). Office365 uses this to find out which ADFS server is redirecting you to at a preliminary stage.

If you log in from a domain, you get authentication immediately through the built-in auth. ADFS will redirect you back to Office365 to establish a session, and Office365 will log in to the application itself. If you are outside the domain, you will need an external ADFS proxy. There, instead of the built-in auth windows, this special ADFS proxy server asks the user for corporate credentials, and then redirects back to Office365 in the same way as before.

Here is a good document that explains all this in more detail:

http://www.microsoft.com/download/en/details.aspx?id=28971

+5
source

Source: https://habr.com/ru/post/910072/

More articles:


All Articles