Azure connect - ADFS with my SSO

Question

Hello everyone,

I'm a Belgian student and I'm currently intern in a small company.

My project is to create a SSO (Gluu) server and integrate Office 365 with it, so the purpose is that all users connect once and have access to all the services/websites configured in the SSO.

I would like to connect my SSO to Office 365 and I would like that my SSO do the authentication of all users in external network and internal. I have seen that it could be possible using a proxy ADFS but I have asked to my sysadmin but it's not possible. So I'm looking for another solution.

Here is a schema of my infrastructure.

Thank you very much.

Answer 1

Hello Julien,

Thanks for your reply with patience.

If you prefer the Pass Through Authentication (PTA) to sync your AD users to Office 365 Azure AD, this is OK.  However,  you would not be able to continue using ADFS integrate your own SSO service for user authentication. For more details about Pass Through Authentication with AAD conect, please refer to User sign-in with Azure Active Directory Pass-through Authentication.

Moreover, if you still want to use AFDS for user authentication, you cannot enable Pass Through Authenticaiton, and for the external users authentication, you need to deploy ADFS proxy just as we talked before, thanks.  And if you don't use ADFS in the future, and only want to sync your AD users to Office 365 Azure AD with SSO experience, you could try to enable the Semless SSO feature with AAD connect ( Not your own SSO) and in this way, your Office 365 users would get a SSO experience from the domain-joined devices. For your reference Azure Active Directory Seamless Single Sign-On.  

Please feel free to let me know if you have any other concerns, thanks.

Regards,

Oliver

Answer 2

Hello Julien,

I am glad to help for your concern here.

Based on the instrusture picture you provided above, first as far as I know if your own SSO provider service can be integrated with ADFS to authenticate Office 365 users sign in,  your schema is OK for Office 365 Intranet (internal network) authentication with ADFS. However, if you want your Office 365 users to be authenticated from external network with ADFS, as far as I know you must deploy ADFS proxy server for that just as you said above.  However, since you cannot deploy ADFS proxy server, the external authenticate requests cannot be delivered to your Intranet (ADFS), so you cannot make your external network users get authenticated with your ADFS. 

Your understanding will be highly appreciated.

Best Regards,

Oliver

Answer 3

Thank you for your answer. 

Yes I understand, but is it possible to use pass-through authentication but instead of using the AD to check authentication using my SSO ?

Thank you.

Answer 4

Hello Julien,

If you have any other concerns, please feel free to share with me, thanks.

Best Regards,

Oliver