Setting up SSO with Office 365

To create an SSO application for Office 365

1. In the navigation sidebar, expand Applications and click Manage Applications.
2. From the Actions pane of the Applications page, click Create Application. 
   
   
   
   This opens the Application Details form, which contains tabs and fields for creating the application.
   
   
   
   
3. On the General tab, configure these options for the application:
   1. Name, Display Name and Description — Enter Office 365.
   2. Icon — Leave the path intact, but change the file name from Genric-1.png to office-365.png.
      This displays EmpowerID's Office 365 image to users in their EmpowerID Personal Applications page.
   3. Full URL (Exact Match Path) — Leave this field blank as it is not used for Office 365.
   4. Base URL for HTTP Module — Leave this field blank as it is not used for Office 365.
   5. Allow Access Requests — Leave this option selected to allow users to request or claim accounts in the application in the IT Shop.
   6. Allow Claim Account — Leave this option selected to allow users to claim an account in the application from the IT Shop.
   7. Allow Request Account — Leave this option (and Allow Access Requests) selected to allow users to request an account in the application.
   8. Login Is Email Address (Receive OTP to Claim) — Select this option (required for Office 365) to pass identity assertions to the application when logging in from EmpowerID and to send a one-time password to users claiming an account.
   9. Make me the Application Owner  — Select this to own the application. Application owners can manage the application and approve or deny access requests.
   10. Configure Advanced Claim and Request Account Options  — Only select this option if you have custom pages and workflows configured for processing access requests and managing any accounts linked to the application's EmpowerID account directory. Additional fields appear when you select it.
   11. Is Fulfillment Group Centric — This option is ignored unless the application is tracking only.
   12. Fulfillment Workflow — Leave this option blank as it is only used for tracking-only applications.
       
       
       
       

4. On the Single Sign-On tab, do the following:

   1. Click Single Sign-On Connection Type and select WS-Federation.

   2. Click in the WS-Fed Connection field, press Enter, and click the tile for the Office 365 connection created earlier.
      
      
      
      

5. On the Users tab, click Select existing Account Directory and select your Office 365 Account Store.

   EmpowerID uses this directory to map your Office 365 users with their corresponding EmpowerID Persons. You must add this Account Store to EmpowerID to have it appear in the drop-down.

   
   
   
   

6. Click Add to cart.
7. Click the shopping cart icon at the top of the page, and in the Cart dialog that appears, enter a reason for creating the application and then click Submit.
   
   
   
   

Next, set the Public DNS for your server to match the domain name you are federating in Office 365 as described below. If the two already match you can skip ahead to Configuring a Trusted Endpoint for the SSL certificate used in your EmpowerID deployment.

To configure an EmpowerID server with a DNS Alias

This is an optional step that is only required when the DNS for your server and the domain name you registered in Office 365 are not the same. These values must match for SSL endpoints to function correctly. By setting a DNS, you are directing the EmpowerID services to ignore the machine's FQDN and use the Public DNS in its place.

1. In the navigation sidebar, expand Admin, then EmpowerID Servers and Settings and click EmpowerID Servers.
2. From the EmpowerID Server Details page, click the EmpowerID Servers tab and search for the server whose role you want to set.
3. Click the Edit button for that server.
   
   
   
   

4. In the dialog that appears, enter the DNS Alias in the PublicDns field and click Save.
   
   

   The value entered here must be found in the SSL Certificate (i.e., Subject Name, SAN Cert, etc.).

5. Restart the EmpowerID services on that server.

To export the EmpowerID Certificate in base64-encoding format

1. From the server with your federation certificate, browse to the C:\Program Files\TheDotNetFactory\EmpowerID\Programs\System Certificates folder and locate your federation certificate.
   
   
   
   
2. Next, right-click the certificate and select Install PFX.
   
   
    
3. Select Local Machine and click Next.
   
   
   
   
4. Click Next.
5. Enter the password for the private key, select Mark this key as exportable and click Next.
   
   
   
   
6. Select the Automatically select the certificate store based on the type of certificate option then click Next.
   
   
   
   
7. Click Finish.
8. From MMC, open the Certificates snap-in for the Local Computer and locate the federation certificate in the Personal Store.
   
   
   
   
9. Right-click the certificate and select All Tasks, then Export from the context menu.
   
   
   
   
10. In the Certificate Export Wizard that appears, click Next.
11. Select No, do not export the private key and click Next.
    
    
    
    
12. Select Base-64 encoded X.509 (.CER) and click Next.
    
    
    
    
13. Select an export location, naming the exported certificate and click Next.
14. Click Finish to complete the export.
15. Open the exported certificate in a text editor and remove the first and last lines:
    ----BEGIN CERTIFICATE---- 
    ----END CERTIFICATE----
    
    
    
    
16. Remove all spaces and line breaks so that the certificate appears on one line.
    
    

Next, establish trust between Office 365 and EmpowerID as described below.

To establish trust between Office 365 and EmpowerID

1. To connect to Microsoft Online, run the following command in PowerShell.
   
   

   Connect-MsolService

2. In the Sign in to your account window that appears, enter the email address of a global administrator of your Office 365 account and click Next, then enter the password and click Sign In.
   
   
   
   

3. Once you have connected, run the following command to set the ImmutableID on all Office 365 accounts that have the domain specified in the command. Be sure to replace YourDomainName with the domain name that you own, e.g. mydomain.com.
   
   

   You cannot federate the default domain, e.g., domain.onmicrosoft.com, Microsoft created for your organization when you registered for an Office 365 account. You must add one or more other domains to your Office 365 account, such as mydomain.com, and allow Microsoft to verify that you own those domains. After Microsoft verifies your ownership, you can federate it with EmpowerID.

   This command is only necessary if the account was created in Office 365. Do not run the command if you are using DirSync.

   Get-MsolUser -DomainName YourDomainName |  where {$_.ImmutableId -eq $null -OR $_.ImmutableId -eq ''} | Set-MsolUser -ImmutableId {[guid]::NewGuid().ToString()}

   To get all licensed users and their immutable IDs, run 

   Get-MsolUser -all | where {$_.isLicensed -eq $true} | select-object userprincipalname, immutableid

4. Next, set the following variables at the PowerShell prompt for your domain, the federation endpoints and the signing certificate. The following example shows what the values for the variables looked like for our configuration.
   
   Replace the values with those specific to your environment. For example, the name of our domain is "mydomain.com," so the value of $dom and $FederationBrandName is "mydomain.com," and the name of our connection in EmpowerID is "O365EDU".
   
   Run each line of code separately in PowerShell.

   $dom = "mydomain.com"
   
   $FederationBrandName = "mydomain.com"
   
   $ActiveLogOnUri = "https://sso.empowersso.com/EmpowerIDWebServices/Office365ActiveSTS.svc"
   
   $mex = "https://sso.empowersso.com/EmpowerIDWebServices/Office365ActiveSTS.svc/mex"
   
   $IssuerUri = "https://sso.empowersso.com/WebIdPWSFederation/365/O365EDU"
   
   $LogOffUri = "https://sso.empowersso.com/WebIdPWSFederation/365/O365EDU"
   
   $PassiveLogOnUri = "https://sso.empowersso.com/WebIdPWSFederation/365/O365EDU""
   
   $cert = "MIIC5jCCAc6gAw..............QKgUSV0rciLpDOYiqAwbP6D"    

   The values for the IssuerUri, LogOffUri, and PassiveLogOnUri are the same and point to the Issuer you set up when you created the WS-Fed connection above:

   https://<FQDN-Of-Your-EmpowerID-Font-End-Server>/WebIdPWSFederation/365/<Name-Of-Your-SSO-Connection>

   The value set for the IssuerURI does not need to be a resolvable DNS; however, it does need to be unique in Office 365. An IssuerURI cannot be used for more than one connection or tenant.
   
   The values for the ActiveLogOnUri and mex variables contain the name of your SSO Connection followed by ActiveSTS.svc and ActiveSTS.svc/mex, respectively.
   
    When setting the value for the certificate, be sure to pass in the string without any line breaks, using Base-64 encoding.

   If you received a DefaultDomainUnsetException error when running the above PowerShell cmdlet, you need to specify the domain as the default domain. To fix the error run the below cmdlet. Additionally, you need to run the cmdlet each time you add a tenant to set the default domain for those tenants. Be sure to replace "mydomain.com" with the fully qualified domain name your Office 365 account was given by Microsoft when first created.

   set-msoldomain -name mydomain.com -IsDefault

5. Use the cmdlet below to set the Federation Authentication Mode to WS-Fed for the Office 365 domain. Enter the cmdlet as one line.
   
   

   Set-MsolDomainAuthentication -DomainName $dom -FederationBrandName $dom -Authentication Federated -PassiveLogOnUri $PassiveLogOnUri -SigningCertificate $cert -IssuerUri $IssuerUri -ActiveLogOnUri $ActiveLogOnUri -MetadataExchangeUri $mex -LogOffUri $LogOffUri

   If necessary, you can revert the domain from federated to managed by using the following PowerShell cmdlet.

   Set-MsolDomainAuthentication -DomainName $dom -Authentication Managed

6. Use the following cmdlet to update your Office 365 Domain with the federation settings. Enter the cmdlet as one line.
   
   

   Set-MsolDomainFederationSettings -DomainName $dom -FederationBrandName $dom -IssuerUri $IssuerUri -LogOffUri $LogOffUri -PassiveLogOnUri $PassiveLogOnUri -ActiveLogOnUri $ActiveLogOnUri -MetadataExchangeUri $mex -SigningCertificate $cert

7. Run the following cmdlet to verify your settings.
   
   

   Get-MsolDomainFederationSettings -DomainName $dom

   
   You should see the federation settings you entered above reflected in the output.
   
   
   
   

8. Close your session by running the following cmdlet.
   
   

   Get-PSSession|Remove-PSSession

To test the Office 365 SSO Connection

1. From your Web browser navigate to the login for Office 365 and enter your username.
   
   
   
   
2. Click Next. A message should appear stating that Office 365 is redirecting you to your organization's sign-in page.
   
   
   
   

3. Log in to the EmpowerID Web application as you normally would. The username is the same as that used for accessing Office 365.
   
   

   If you have yet to claim an account, EmpowerID will direct you to register the account to your person.

4. EmpowerID verifies your identity and redirects you back to Office 365.