These steps will guide you through setting up the single sign-on functionality between ADSelfService Plus and Office 365.
Using Azure AD Connect
GUID as sourceAnchor: If you have Azure AD Connect, then use it to update the sourceAnchor attribute in Office 365 with AD’s GUID attribute value.
Other unique AD attribute as sourceAnchor: If you have already assigned a different attribute value other than GUID for the sourceAnchor attribute, then use the Account Linking option in ADSelfService Plus to map it with the corresponding attribute in Active Directory.
Using a third-party GUID to ImmutableID converter tool
Convert GUID to ImmutableID: If you don’t have Azure AD Connect, then you can download a third-party ‘GUID to ImmutableID converter’ tool. Use the tool to convert the GUID value of each user to ImmutableID values and update them in Office 365.
Update the ImmutableID value in Office 365: Once you have converted the GUID to ImmutableID, you need to update the value in Office 365 for each user using the PowerShell commands given below.
Command to update ImmutableID attribute while creating new users
$cred = Get-Credential
Connect-MsolService -Credential $cred
New-MsolUser -UserPrincipalName "user01@mycompany.com" -ImmutableId "<immutable_id>" -DisplayName "user 01" -FirstName "user" -LastName "01" -LicenseAssignment "<service_pack>" -UsageLocation "<location>"
Note: You can check whether the update was successful using this command: Get-MsolUser -All | select userprincipalname,ImmutableId
Command to update ImmutableID attribute for existing users
Set-Msoluser -UserPrincipalName "<user_mailID>" -ImmutableID “<immutable_id> ”
Login to ADSelfService Plus as an administrator.
Navigate to Configuration → Self-service → Password Synchronizer.
Locate and click on Office 365 in the list of applications provided.
Click on the Download SSO Certificate link in the top-right corner of the screen.
In the pop-up that appears, copy the Login URL and download the SSO certificate by clicking on the Download SSO Certificate.
Office 365 (Service Provider) configuration steps
Open Powershell with Admin rights.
Enter the below command. In the pop-up that appears, enter username and password of your Office 365 administrator account.
$cred = Get-Credential
Connect with MsolService using the following command.
Connect-MsolService -Credential $cred
Get-MsolDomain
This command will show a list of domains.
Note:
SSO can be enable only for domains that have the Status as Verified.
SSO can be enabled only for non-admin domains (domains that doesn't have onmicrosoft.com subdomain).
Enter the domain for which you would like to enable SSO.
$dom = "mycompany.com"
Enter the Login URL value from Step 5 of Prerequisite for $url and $uri commands, and Logout URL value for $logouturl command.
$url = "<login URL value>"
For example, $url = "https://selfservice.com:9251/iamapps/ssologin/office365/1352163ea82348a5152487b2eb05c5adeb4aaf73"
$uri = "<login URL value>"
For example, $uri = "https://selfservice.com:9251/iamapps/ssologin/office365/1352163ea82348a5152487b2eb05c5adeb4aaf73"
$logouturl = "<logout URL value>"
For example, $logouturl = "https://selfservice.com:9251/iamapps/ssologout/office365/1352163ea82348a5152487b2eb05c5adeb4aaf73"
Now copy the SSO Certificate file content (from Step 5 of Prerequisite) and past it as the value fo the below command.
Important: Please edit the file so that there aren't any new line before you copy the content.
$cert = "MIICqjCCAhOgAwIBAgIJAN..........dTOjFfqqA="
Run the below command to enable SSO in Office 365.
Set-MsolDomainAuthentication -DomainName $dom -FederationBrandName $dom -Authentication Federated -PassiveLogOnUri $url -SigningCertificate $cert -IssuerUri $uri -LogOffUri $logouturl -PreferredAuthenticationProtocol SAMLP
To test the configuration, use the following command.
Get-MSolDomainFederationSettings -DomainName "mycompany.com" | Format-List *
Reconfigure or update SSO settings: If you are already using SSO for Office 365 from another identity provider or want to update ADSelfService Plus SSO settings, then you must first disable SSO in Office 365, and then follow the steps in this guide. To disable SSO in Office 365, use the command given below:
$dom = "mycompany.com"
Set-MsolDomainAuthentication -DomainName $dom -FederationBrandName $dom -Authentication Managed
ADSelfService Plus (Identity Provider) configuration steps
Now, switch to ADSelfService Plus’ Office 365 configuration page
Choose Single sign-on under Modules.
In the Domain Name field, enter the domain name you used in Step 4 of Office 365 configuration.
Provide a Description in the respective field.
In the Available Policies field, click on the drop-down box and select the policies for which you wish to enable single sign-on.
Click Save and log out of ADSelfService Plus.
|
|
For Office 365, single sign-on is supported for SP and IdP initiated flow. |
