Are on-premise web applications using Basic Authentication method supported by Azure AD Single Sign-On ?
Related
What is Azure AD connect and Azure ADFS? This is what I have understood: Azure ADFS is exposing on premises AD to Azure cloud and Azure AD connect is means to do that. Am I right?
We need to build an application which needs to authenticate users from different clients' AD. They may or may not have exposed their AD to Azure. Can someone please guide how can this problem be solved?
Azure ADFS is exposing on premises AD to Azure cloud and Azure AD connect is means to do that.
AS of now, the way Azure ADFS works, it essentially provides a way for a company to use AD and ADFS services, without having to deploy themselves. Just like how a Azure has Azure Web App will allow you to have a web server without having your own.
Unfortunately, It does not actually connect or integrate or expose your on premise AD. If you want your clients authenticate against multiple IDs, you do it the old fashioned way, by connecting to the on-premises AD directly. You cannot actually route it through Azure.
One thing which you can do (this will be a huge endeavour) is to move the on premises AD to Azure cloud, which can be done using Azure VMs. Now, that would allow your client to get rid of their on premises AD and use the Azure cloud for everything.
I am trying to make Windows Authentication (with Kerberos/NTLM) work in a Web App hosted in IIS using Azure AD Federated users but seems it does not work. Below are the whole infrastructure details:
I have an Azure AD (e.g. skj.onmicrosoft.com) with Azure AD Domain Services Configured
I have an on premises Windows AD (e.g. skjtest.com) which is federated with the Azure AD. The on-prem users are available in AAD, SSO works but the password hash is not synced with AAD.
A VM is created in Azure and joined to the AAD Domain skj.onmicrosoft.com
I created a Web App which uses Windows Authentication and hosted in IIS present in the above Azure VM
When I try to login using an AAD user (e.g. aaduser1#skj.onmicrosoft.com) to the web app, it works all fine using both Kerberos and NTLM
However when I try to login using a federated identity (e.g. feduser1#skjtest.com), it fails showing a 401 Unauthorized Status code.
Here my question is, is this at all possible to make the Windows Auth (with Kerberos or NTLM) work with the Federated identities? If yes, please let me know the ways I can achieve this.
What could be the ways to integrate a web application ( on-prem) to another web application (Azure) using azure AD authentication( happening in the background), with out the user being prompted for credentials.
It depends on how your on-premise application authenticated. Based on the description, you want to implement the single sign-on for the on-premise application with the application which protected by Azure AD.
In this scenario, you can deploy ADFS on-premise and make the on-premise web application authenticate by the ADFS. Then we need to enable the trust from the ADFS to Azure AD. After build the federated trust, when the users try to access the web application which protect by Azure AD will redirect to the ADFS, and if the users already authenticate the on-premise application they will not required to enter their credential again. Here is a figure to demonstrate this progress and you can refer more detail about it from this link.
And now, we can use Azure AD connect to integrate your on-premises directories with Azure Active Directory easily. You can refer the video on this link about different settings for this tool.
How to deploy an MVC application with LDAP authentication and AZURE SSO?
Azure AD domain services ( preview) enables applications that use LDAP ( on enterprise on premises ) to be hosted on azure. If authenticating to LDAP as well as azure AD is requirement( not sure if this is the exact use case) this is something you can look at
https://azure.microsoft.com/en-in/documentation/articles/active-directory-ds-overview/
I have connected an Azure VM with Azure AD Domain Services. I am trying to set up sso for IIS web app which authenticates users using Integrated Windows.
I have followed the guide to setup the Application Proxy and I am stuck at Delegating KCD. https://azure.microsoft.com/en-us/documentation/articles/active-directory-application-proxy-sso-using-kcd/
Has anyone tried to authenticate users with Integrated Windows Authentication via Azure AD SSO?
This is not possible as in Azure AD Domain Services you don't have access to the domain controller so you can't configure KCD for the connector.
Disclaimer - I worked in the App Proxy team :-)