webnetwork Office 365 SSO integration v

Transcription

1 webnetwork Office 365 SSO integration v Guide will cover: How to configure webnetwork SAML application How to prepare Office 365 for Single Sign-On How to configure Office 365 Single Sign-On How to turn off Single Sign-On How to create links to Office 365 How to configure webnetwork SAML application Purpose: Steps: Create the Public application in webnetwork that will connect to Office 365 via SAML Create the certificate to be shared with Office Right-click on Applications Admin and click Create Public Application 2. Enter Office365 and click Next 3. Verify created successfully and click Close 4. Click Authentication tab and choose Office 365 for type 5. Enter variable for Identity 6. Enter URL for Assertion Consumer 7. Click Wizard for PFX Certificate and choose RSA 2048 then click Generate button 8. Click Overwrite button 9. Click Wizard button for Certificate 10. Input values then click Generate button 11. Verify certificate was generated 12. Select all text and copy to Notepad, then save file as office365-cert.txt 13. Click Overwrite button 14. Click Assertion for SAML Signature Location 15. Add input Audience 16. Click Save button 17. Click Properties tab and add Context Path (Alias) 18. Add all webrelay objects to Assigned Relays 19. Click the Provisioning /Attributes tab and enable Provision 20. Add the remote attribute IDP and local attribute then click OK 21. Add the remote attribute ImmutableID and local attribute then click OK 22. Add the remote attribute UserPrincipalName and local attribute then click OK Page 1

2 23. Click Save button *** The Provisioning tab changes to Attributes in webnetwork and higher. *** This document has been modified to include the commands to allow Outlook and other "fat" clients to authenticate against webnetwork when Office 365 is federeated. 1. Right-click on Applications Admin and click Create Public Application Page 2

3 2. Enter Office365 and click Next Page 3

4 3. Verify created successfully and click Close Page 4

5 4. Click Authentication tab and choose Office 365 for type Page 5

6 5. Enter variable for Identity requires webnetwork or newer Page 6

7 6. Enter URL for Assertion Consumer Page 7

8 7. Click Wizard for PFX Certificate and choose RSA 2048 then click Generate button Page 8

9 8. Click Overwrite button Page 9

10 9. Click Wizard button for Certificate Page 10

11 10. Input values then click Generate button IMPORTANT - Make sure to pick SHA-1 Input your company values and NOT the ones provided below Page 11

12 11. Verify certificate was generated Page 12

13 12. Select all text and copy to Notepad, then save file as office365-cert.txt Page 13

14 13. Click Overwrite button Page 14

15 14. Click Assertion for SAML Signature Location Page 15

16 15. Add Audience urn:federation:microsoftonline Page 16

17 16. Change Close Window for the SAML Logout Behavior Page 17

18 17. Click Save button Page 18

19 18. Click Properties tab and add Context Path (Alias) /Office365 Page 19

20 19. Add all webrelay objects to Assigned Relays Below example only shows 1 webrelay, but if you have more webrelays you should add them now Page 20

21 20. Click the Provisioning tab and enable Provision Page 21

22 21. Add the remote attribute IDP and local attribute then click OK Attribute should be users Office 365 address Page 22

23 22. Add the remote attribute ImmutableID and local attribute then click OK Attribute must be base64 encoded GUID and match ImmutableID in Office 365 Page 23

24 23. Add the remote attribute UserPrincipalName and local attribute then click OK Use or Attribute must match Office 365 UserPrincipalName Page 24

25 24. Click Save button How to prepare Office 365 for Single Sign-On Purpose: Steps: Download tools necessary to connect to Azure cloud and turn on SSO Make sure you have two admin accounts in each domain, so you will not get locked out if SSO configuration fails for Office Download utilities 2. Create Office 365 domain 3. Create back-up administrator account Page 25

26 4. Login with back-up administrator account 1. Download utilities Download and install Microsoft Services Sign-In Assistant Download and install Azure AD Any workstation 2. Create Office 365 domain IMPORTANT - must be different domain to turn on Single Sign-On 3. Create back-up administrator account In the event that you federate your domain unsuccessfully and are disconnected from Powershell session, you'll need an admin in domain to turn off federation. Office Create a User Office Assign Admin Role Page 26

27 4. Login with back-up administrator account Verify you can login with back-up administrator account on domain How to configure Office 365 Single Sign-On Purpose: Steps: Need to turn on federation using powershell 1. Run Windows Azure Active Directory Module for Windows PowerShell 2. Run Connect-MsolService and login with admin creds 3. Run command to verify ImmutableId is populated 4. Open Notepad and paste in the following script 5. Save file as turn-on.ps1 6. Run command.\turn-on.ps1 Page 27

28 7. Test login 8. Login with AD creds 9. Verify login was successful 10. Turn off SSO 1. Run Windows Azure Active Directory Module for Windows PowerShell Page 28

29 2. Run Connect-MsolService and login with admin creds Connect-MsolService Page 29

30 3. Run command to verify ImmutableId is populated Get-MsolUser -UserPrincipalName format-table -property ImmutableID Value will be base64 encoded and should be the same value as IMPORTANT - if users do not have ImmutableID defined, they will not be able to login with SSO method If ImmutableId value is empty for user, then run command Set-MsolUser - UserPrincipalName user@yourdomain.com -ImmutableID USERVALUE 4. Open Notepad and paste in the following script (edit the parts in RED) $dom = "YOURDOMAIN.com $BrandName = "Stoneware" $url = " $logouturl = " $uri = " $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\Users\ Administrator\Desktop\O365\office365-cert.txt") Page 30

31 $certdata = [system.convert]::tobase64string($cert.rawdata) $MetadataExchangeUri = " Office365" $Protocol = "SAMLP" $activeurl = " Set-MsolDomainAuthentication -DomainName $dom -FederationBrandName $BrandName - Authentication Federated -PassiveLogOnUri $url -SigningCertificate $certdata -IssuerUri $uri -LogOffUri $logouturl -MetadataExchangeUri $MetadataExchangeUri - PreferredAuthenticationProtocol $Protocol -ActiveLogOnUri $activeurl Page 31

32 5. Save file as turn-on.ps1 Page 32

33 6. Run command.\turn-on.ps1 If you receive an error about running scripts, you may have to allow scripts to run with powershell Page 33

34 7. Test login After typing in username and hitting tab, it should redirect to your webnetwork login page Page 34

35 8. Login with AD creds Page 35

36 9. Verify login was successful Page 36

37 How to turn off Single Sign-On Set-MsolDomainAuthentication -Authentication Managed -DomainName YOURDOMAIN.com How to create links to Office 365 Purpose: Steps: If user is already in webnetwork, you want a simple link to Office 365 application 1. Go to webadmin tool 2. Expand Link Menu Admin folder 3. Expand desired location 4. Right-click and select Create Link 5. Type in Office365-link then click Next button 6. Verify the link was created successfully then click Close button 7. Enter description 8. Enter URL 9. Click the green + for Assigned To 10. Assign users/groups/ous then click OK button 11. Click Save button Page 37

38 12. Logout 13. Login 14. Click Office 365 tile 1. Go to webadmin tool Page 38

39 2. Expand Link Menu Admin folder Page 39

40 3. Expand desired location Page 40

41 4. Right-click and select Create Link Page 41

42 5. Type in Office365-link then click Next button Page 42

43 6. Verify the link was created successfully then click Close button Page 43

44 7. Enter description Page 44

45 8. Enter URL Office 365 Portal &wa=wsignin1.0&wtrealm=urn:federation:microsoftonline Outlook Page 45

46 9. Click the green + for Assigned To Page 46

47 10. Assign users/groups/ous then click OK button Page 47

48 11. Click Save button 12. Logout Page 48

49 13. Login Page 49

50 14. Click Office 365 tile Page 50