A word about modern authentication Modern authentication is an OAuth-based authentication stack used by Office 2013/2016 client applications against Office 365. This enables sign-in features such as Multi-Factor Authentication (MFA), SAML 2.0-based third-party identity providers with Office 2013/2016 client applications, smart card and certificate-based authentication, and it removes the need for Outlook to use the basic authentication protocol. From a technical implementation standpoint, the Active Directory Authentication Library (ADAL) replaces, for Windows clients, the Microsoft Online Sign-in Assistant (SIA). Understanding seamless SSO flows Let’s illustrate a typical seamless SSO flow. Figure Seamless SSO flow First the user attempts to access a resource that trusts security tokens issued from Azure AD, such as SharePoint Online (SPO) for Office 365. SharePoint Online then redirects the user to authenticate against Azure AD. The user is then invited to provide their username so that Azure AD can establish if the seamless SSO feature is enabled for their organization. Assuming seamless SSO is enabled for the organization, the following occurs: Azure AD challenges the client, via a 401 unauthorized response, to provide a Kerberos ticket. The client requests a ticket from Active Directory for the Azure AD. Active Directory locates the computer account, created by Azure AD Connect and returns a Kerberos ticket to the client, encrypted with the machine account's secret. The ticket includes the identity of the user currently signed in to the computer. The client sends the Kerberos ticket it acquired from Active Directory to Azure AD. Azure AD decrypts the Kerberos ticket using the previously shared key, and then either returns a token to the user or asks the user to provide additional proofs such as multi-factor authentication as required by the resource. Seamless SSO is an opportunistic feature, which means that if it fails for some reason, the user simply need only enter their password on the sign-in page as usual.
A word about modern authentication Modern authentication is an OAuth-based authentication stack used by Office 2013/2016 client applications against Office 365. This enables sign-in features such as Multi-Factor Authentication (MFA), SAML 2.0-based third-party identity providers with Office 2013/2016 client applications, smart card and certificate-based authentication, and it removes the need for Outlook to use the basic authentication protocol. From a technical implementation standpoint, the Active Directory Authentication Library (ADAL) replaces, for Windows clients, the Microsoft Online Sign-in Assistant (SIA). Understanding seamless SSO flows Let’s illustrate a typical seamless SSO flow. Figure Seamless SSO flow First the user attempts to access a resource that trusts security tokens issued from Azure AD, such as SharePoint Online (SPO) for Office 365. SharePoint Online then redirects the user to authenticate against Azure AD. The user is then invited to provide their username so that Azure AD can establish if the seamless SSO feature is enabled for their organization. Assuming seamless SSO is enabled for the organization, the following occurs: Azure AD challenges the client, via a 401 unauthorized response, to provide a Kerberos ticket. The client requests a ticket from Active Directory for the Azure AD. Active Directory locates the computer account, created by Azure AD Connect and returns a Kerberos ticket to the client, encrypted with the machine account's secret. The ticket includes the identity of the user currently signed in to the computer. The client sends the Kerberos ticket it acquired from Active Directory to Azure AD. Azure AD decrypts the Kerberos ticket using the previously shared key, and then either returns a token to the user or asks the user to provide additional proofs such as multi-factor authentication as required by the resource. Seamless SSO is an opportunistic feature, which means that if it fails for some reason, the user simply need only enter their password on the sign-in page as usual.
AAD-Office-365-Seamless-Sign-In-Part-6.docx