Customer Story: Achieving consistent SSO with AD FS 2.0 and Office 365 for education
AD FS 2.0 offers institutions who are deploying Office 365 for education a really rich and effective way to provide a single sign-on experience to users. With just one set of credentials teachers and pupils can access the full range of resources that Office 365 for education has to offer.
For some institutions there are certain situations where SSO isn’t fully consistent across users and devices. Helpfully, the good folks at the University of Newcastle here in the UK have come up with a workaround.
The following post represents a solution that is not supported by Microsoft.
Background
The ADFS Farm + ADFS Proxy Farm model that we are using for Office 365 requires that the CNAME of the ADFS service has to be the same for both the ADFS proxy server farm and the internal ADFS farm (in our case adfs.ncl.ac.uk). Users ‘inside’ our network need to be directed to the internal farm and external users to the proxy farm.
ADFS supports multiple authentication mechanisms including the ones we are interested in, Windows Integrated Authentication (WIA) andForms Based Authentication (FBA). It seems however that there is no way to dynamically select which one is used when a request hits the farm based on client properties. Where Office 365 is concerned a farm uses WIA or FBA
The way our network is configured means that we do not have the network model of Internal/DMZ/Internet with the split-brain DNS that the Microsoft documentation seems to expect. Our systems point at a single zone (running on BIND) which resolves both internal and external requests. As such, private IP addresses such as that of the internal ADFS Farm can be resolved (but obviously not connected to) from the Internet.
Working with our Network team we were able to get around this by creating a work around in BIND so that anyone on the Internet receives the address of the proxy farm and anyone coming from one of our internal IP ranges receives the address of the ADFS farm.
The problem for us is that only around 70% of our internal clients are domain joined and as such able to take part in SSO using WIA. The other devices may be non-Windows machines, non-domain joined Windows machines and mobile devices. Because they are coming from one of our internal address ranges they are directed to the internal WIA enabled ADFS farm and get a non-user friendly ugly pop-up box requesting authentication.
We do not think that this is a good user experience so we sought a solution which would let us provide both authentication methods to internal clients.
Possible Solutions
After discussions internally and with Microsoft we were presented with 3 possible ways to deal with this problem.
- Our Network team could define every IP range we have and point them at the relevant BIND DNS view. This is obviously an inelegant solution and would not cover all scenarios as many ranges in our environment contain both domain joined and non-domain joined clients. It would however work for wireless guests as they are on specific ranges.
- Microsoft proposed pushing out a HOSTS file to all domain joined clients pointing them at the internal farm. This not a scalable or suitable option in our environment as we have development work going on all over the University and this would essentially remove people’s ability to use the HOSTS file due to it being overwritten by whatever mechanism we would put in place to the job
- The third option was suggested by a Microsoft representative on the Office 365 community forums. The ADFS Farm could be configured to read a custom attribute from the browsers User agent string. This value would be parsed server-side and if present the request would be authenticated by WIA. Other requests would be forwarded on to FBA. This was particularly attractive to us as we already use a custom user agent string value for Shibboleth authentication.
What we lacked was the expertise to implement this solution but thanks to collaboration with our colleagues as well as working with members of the Microsoft TechNet community we were able to implement something that seems to do the job for us. We thought we would share this in the event others are running in to the same problem!
Out Of The Box Authentication With AD FS 2.0
The mechanism that is used by default on an ADFS farm or proxy Farm can be toggled in the <localAuthenticationTypes> element of the ADFS web.config:
1: <microsoft.identityServer.web> 2: <localAuthenticationTypes> 3: <add name="Forms" page="FormsSignIn.aspx" /> 4: <add name="Integrated" page="auth/integrated/" /> 5: </localAuthenticationTypes>
For WIA ‘Integrated’ is at the top of the list:
1: <microsoft.identityServer.web> 2: <localAuthenticationTypes> 3: <add name="Integrated" page="auth/integrated/" /> 4: <add name="Forms" page="FormsSignIn.aspx" /> 5: </localAuthenticationTypes>
Implementing Selective Authentication using the User Agent String
Manipulation of the User Agent string on Internet Explorer, Firefox and Chrome
The first thing required is to append the user agent string to browsers. This can be done in Internet explorer using Group Policy:
- Under User Configuration expand Windows Settings/Internet Explorer Maintenance
- Select ‘Connection’
- In the right-hand pane, double-click User Agent String.
- On the User Agent String tab, select the ‘Customize String To be Appended To User Agent String check box
- Type in the string (in our case campus-ncl).
We have this value set in the ‘Default Domain Policy’ though it could be set lower down.
For Firefox and Chrome things have to be done in the application deployment package. Obviously people will have to use a managed version of the product as it’s not exactly a user friendly setup!
In Firefox the prefs.js file requires to extra lines:
user_pref("network.negotiate-auth.trusted-uris", "");
user_pref("general.useragent.override", ", ")
So in our environment:
user_pref("network.negotiate-auth.trusted-uris", "adfs.ncl.ac.uk");
user_pref("general.useragent.override", ", campus-ncl")
Chrome needs to be run with some extra switches:
--auth-server-whitelist="ADFS FQDN" --user-agent=" <actual agent string> + <customstring>
So in our environment:
--auth-server-whitelist="adfs.ncl.ac.uk" --user-agent=" <actual agent string> + campus-ncl"
Disable Extended Protection must be disabled on the ADFS Farm in IIS (for Firefox and Chrome only)
In order to get SSO working with Firefox and Chrome Extended Protection must be disabled on the ADFS Farm in IIS. Lots of information on this feature and the consequences of disabling it can be found with a simple search on the Internet.
AD FS Farm Modifications
There are 2 steps required on the ADFS farm.
- Enable Forms Based Authentication as the default method.
- Modify the FormsSignIn.aspx.cssource code file
To turn on FBA edit the <localAuthenticationTypes> element of the ADFS web.config file and make sure FBA ‘Forms’ is at the top of the list:
1: <microsoft.identityServer.web>
2: <localAuthenticationTypes>
3: <add name="Forms" page="FormsSignIn.aspx" />
4: <add name="Integrated" page="auth/integrated/" />
5: </localAuthenticationTypes>
Next open the FormsSignIn.aspx.cs Source Code File.
The default out of the box, the code looks like this:
1: using System; 2: 3: using Microsoft.IdentityServer.Web; 4: using Microsoft.IdentityServer.Web.UI; 5: 6: public partial class FormsSignIn : FormsLoginPage 7: { 8: protected void Page_Load( object sender, EventArgs e ) 9: { 10: } 11: …
We need to add some code to the Page_Load event which will forward the request to integrated authentication if the campus-ncl user agent string is present. In order to do this we had to add System.Web to the namespace list.
1: using System; 2: using System.Web; 3: using Microsoft.IdentityServer.Web; 4: using Microsoft.IdentityServer.Web.UI;
System.Web supplies the classes that enable browser-server communication which are needed to get the user agent string and the query string generated by Microsoft Online Services.
1: protected void Page_Load( object sender, EventArgs e ) 2: { 3: //Get the raw query String generated by Office 365 4: int pos = Request.RawUrl.IndexOf('?'); 5: int len = Request.RawUrl.Length; 6: string rawq = Request.RawUrl.Substring(pos + 1, len - pos - 1); 7: 8: //Convert query string (qs) to a string 9: string qs = HttpUtility.ParseQueryString(rawq).ToString(); 10: 11: //Get the user agent value 12: string uagent = Request.UserAgent; 13: 14: //Check if the string campus-ncl appears in the User Agent 15: //If it is there forward to WIA along with the Query String 16: 17: if(uagent.IndexOf("campus-ncl") > -1) 18: { 19: Response.Redirect("/adfs/ls/auth/integrated/?" + qs, true); 20: } 21: else 22: { 23: //Carry on and do Forms Based Authentication 24: } 25: }
And that’s it! Anyone using a managed browser with the custom string will be forwarded for WIA and get the SSO experience and all others will get FBA.
Things to note:
- This method is not officially supported by Microsoft and there are potential issues around future ADFS upgrades (there is no guarantee that the same configuration will be in future versions of ADFS). We are also developing the fall back plan of pointing different clients and the different farms in DNS in case it is needed.
- There may very well be a better way to do this! If you find one please let us know
Special mention
Although we knew what we wanted to do we were having trouble getting the query string and putting it in a usable form (I’m not a programmer!) This information was provided by another TechNet forum member.
Are you using AD FS 2.0 for SSO?
What tips would you give any institutions looking to deploy Office 365 for education summer? Do you have a story like that you’d like to share on our blog? Let us know in the comments!