SSO means different things to different people – make sure you’re talking about the same thing (i.e. Single Sign-On, Simple Sign-On or Same Sign-On)
- Your browser or client application needs to support WIA and claims
IE/Edge support WIA out of the box, Firefox can reportedly be configured to support it (Chrome and others possibly as well using the same steps) - Your browser must be talking to the intranet ADFS servers (as talking to the ADFS proxies takes you through forms-based authentication)
This is frequently done through either a split-brain DNS setup or a network device that routes internal claim requests directly to the internal ADFS servers and external claim requests to the ADFS proxies - Your browser must trust that the ADFS farm is an intranet web site that (the site should be in the Local Intranet sites in Internet Settings)
Adding a GPO setting to include the ADFS farm name will work, targeting the GPO at the Computer gives the User the flexibility to add any required additional entries as the user settings inherit any sites added at the computer settings level. - You must be logged on to a domain-joined machine as the user you expect SSO to be provided for
Note that a cached logon doesn’t really count as a proper logon (you’re simply being allowed access to local resources on the workstation based on a previously successful logon)
- The Relying Party application should redirect you to the ADFS farm when it detects you are attempting to log on using an account beloging to a domain suffix that their IDP is responsible for
This should preferably done immediately upon entering the account name when switching focus to the password field, entering the password at the RP side shouldn’t be required at all (f.x. an onFocus event targeting the password field, similar to what https://portal.office.com does).
Support for Windows Integrated Authentication in Firefox
http://justgeeks.blogspot.co.nz/2011/01/firefox-supports-integrated-windows.html
Configuring Chrome and Firefox for Windows Integrated Authentication
http://www.sitehelpdesk.com/sitewebdesk
onFocus event
http://www.w3schools.com/jsref/event_onfocus.asp
Split-Brain DNS
https://msdn.microsoft.com/en-us/library/ms954396.aspx
A faulty split-brain DNS configuration can prevent a seamless SSO sign-in experience
https://support.microsoft.com/en-us/kb/2715326
Office 365 Single Sign-On with AD FS 2.0 whitepaper
http://www.microsoft.com/en-us/download/details.aspx?id=28971
A federated user is prompted unexpectedly to enter their credentials when they access an Office 365 resource
http://support.microsoft.com/kb/2535227
A federated user is repeatedly prompted for credentials when he or she connects to the AD FS 2.0 service endpoint during Office 365 sign-in
http://support.microsoft.com/kb/2461628