360 Online authentication

Transcription

1 360 Online authentication Version October 2015 This document will help you set up a trust for authentication of 360 Online users between Azure Access Control Service and either Office 365 or Active Directory Federation Services. Software Innovation

2 Contents 1 Introduction Authentication using Office Introduction Prerequisites Step by step Authentication using on-premise Active Directory Federation Services Introduction Prerequisites Integration setup step by step Finding the WS-Federation URL Introduction Users for 360 Online are authenticated by Azure Access Control Service (ACS), which supports several authentication sources, including: Office 365 on-premise Active Directory Federation Services. This document explains how to configure ACS to work with these two authentication methods. 2 Authentication using Office Introduction The following steps are required to enable authentication of 360 Online user with Office 365: a. Create a Windows Azure account b. Configure 360 Online as a new application in your organisation s Azure Active Directory 2.2 Prerequisites The administrator account for your organisation s Office 365 subscription. A valid credit card for the registration of the Windows Azure account. The Azure Active Directory is a free service but registration requires a valid credit card for payment method. Software Innovation 2014 Page 2 of 14

3 2.3 Step by step STEP 1: Verify that you have the administrator account Open in your browser and log in. If you can see Office 365 admin center, you have the correct account information. STEP 2: Register for a Windows Azure account 1. Open in your browser. 2. Sign in with your Office 365 administrator account. 3. Complete the registration form, enter verification code and enter your organization s credit card information. 4. Select the Pay-As-You-Go offer and complete the registration. Once the page displays your current subscription, you can continue to the next step. STEP 3: Add an application to Azure Active Directory 1. Open in your browser and log in with your Office 365 administrator account. The credentials for both your Office 365 subscription and your Azure Account are the same. 2. Scroll down and select ACTIVE DIRECTORY in the left hand menu. Software Innovation 2014 Page 3 of 14

4 3. Select APPLICATIONS in the top menu. 4. Click ADD on the bottom menu and click Add an application my organization is developing in the next window. 5. Enter the name of your application - Business 360 Online or Public 360 Online and click the right arrow to continue. 6. To establish a trust between your Office 365 authentication and Software Innovation s authentication, enter the following URL in both fields and click the check button: You have now successfully added the application. Software Innovation 2014 Page 4 of 14

5 STEP 4: Retrieve Federation Metadata Document URL 1. Click ENABLE USERS TO SIGN ON. 2. Copy the FEDERATION METADATA DOCUMENT URL and send it to Software Innovation s Customer Success Team 360online@software-innovation.com. The setup is now complete. Software Innovation 2014 Page 5 of 14

6 3 Authentication using on-premise Active Directory Federation Services 3.1 Introduction The following steps are required to enable authentication of 360 Online users via on-premise Active Directory: a) On-Premise deployment of Active Directory Federation Services (ADFS) to enable Active Directory federation b) Configure on-premise ADFS with Azure Access Control Service (ACS) as a trusted relying party This document describes (b). (a) is a prerequisite, as described below. If you need help with this setup, contact Software Innovation. Our authentication specialists will be happy to advise you. 3.2 Prerequisites The following are prerequisites for enabling ADFS ACS integration: ADFS server (ADFS 2.0 or higher/windows Server 2008 R2 or higher) has been setup onpremise. These documents provide relevant information: TechNet - ADFS Deployment Guide TechNet - Best Practices for Secure Planning and Deployment of AD FS ADFS Federation metadata URL of the following format should be publically accessible Tenant specific Azure ACS namespace has been configured and the Azure ACS Federation metadata URL is publicly accessible. Software Innovation 2014 Page 6 of 14

7 3.3 Integration setup step by step The following steps setup trust between ADFS and ACS: STEP 1: Navigate to ADFS management screen and click on Add Relying Party Trust STEP 2: Click on Start to initiate addition of relying party Software Innovation 2014 Page 7 of 14

8 STEP 3: In the Select Data Source step add the following metadata URL address Click Next to continue. STEP 4: Leave the default Display name as it is and click on Next to continue to next step. Software Innovation 2014 Page 8 of 14

9 STEP 5: Permit all users to access this relying party is the default selection. Click on Next to continue with next step. STEP 6: Review the Federation metadata URL and click Next without making any changes. Software Innovation 2014 Page 9 of 14

10 STEP 7: Click on Close to launch Edit Claims Rules dialog. STEP 8: In the Edit Claim Rules dialog click on Add Rule to add claims rules. Software Innovation 2014 Page 10 of 14

11 STEP 9: Select Send LDAP Attributes as Claims and click Next. STEP 10: Add -Addresses as displayed in the dialog below. Click Finish to continue Software Innovation 2014 Page 11 of 14

12 STEP 11: Click on Add Rule again to add Windows Account Name to the set of claims. Select Pass Through or Filter an Incoming Claim. Click Next to continue. STEP 12: Add Windows Account Name as mentioned in the dialog below. Click Finish to end the wizard. Software Innovation 2014 Page 12 of 14

13 STEP 13: Click on Add Rule again to add UPN to the set of claims. Select Pass Through or Filter an Incoming Claim. Click Next to continue. STEP 14: Add UPN as mentioned in the dialog below. Click Finish to end the wizard. Software Innovation 2014 Page 13 of 14

14 STEP 15: Click OK to close the Edit Claim Rules dialog and end the configuration setup. 4 Finding the WS-Federation URL The URL for the FederationMetadata.xml is standardized for all ADFS installations. Assuming your ADFS instance is hosted at the WS-Federation URL with the FederationMetadata.xml is located at Return the WS-Federation URL to Software Innovation s Customer Success Team: 360online@software-innovation.com. Software Innovation 2014 Page 14 of 14