About. This is Abdelrahman Muhammad, a Unified Communication Expert at Orange Business services (OBS)

Transcription

1

2 About This is Abdelrahman Muhammad, a Unified Communication Expert at Orange Business services (OBS) I starting my career in IT professional service companies, recently I work on Microsoft Unified Communication products (Skype for Business, Lync, Exchange and SharePoint); also managing, integrating, and troubleshooting other Microsoft technologies, such as but not limited to, Active Directory infrastructure, Hyper-V, SCCM, SCVMM, SCDPM, and FIM/MIM. Abdelrahman Muhammad Abelrahman Muhammad Abdelrahman Muhammad Abdelrahmanpro@hotmail.com

3 Contents SKYPE FOR BUSINESS ONLINE SSO/ ADFS SIGN-IN TROUBLESHOOTING... 4 TROUBLESHOOTING SSO / ADFS... 4 Verify SSO for other apps... 4 Verify user is signing into Windows with correct UPN try to bypass SSO with the DisableNTCredentials policy (create if it does not exist)... 4 verify namespace is federated:... 4 ADFS... 7 OKTA... 9 Ping... 10

4 Skype For Business Online SSO/ ADFS Sign-in troubleshooting This type of account, commonly called a "Federated Identity" or Single Sign On, is created via DirSync where user attributes are sync'd into the service from the on-premise AD. Authentication process involves connecting to the SSO server (ADFS or 3rd party) and receiving a webticket for O365 access. By default, the signed in Windows Account UPN will be automatically passed through to the SSO server as the sign in credentials. If these do not match the SIP account, there will be sign in failure and no rollover to credential prompt. Troubleshooting SSO / ADFS Verify SSO for other apps o Does affected user(s) fail to sign in to O365 web portal? o Are any other O365 applications affected such as Outlook? Verify user is signing into Windows with correct UPN. o In cmd type whoami /upn o this should match the UPN returned from get-csonlineuser try to bypass SSO with the DisableNTCredentials policy (create if it does not exist) o HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\Lync\ o DisableNTCredentials DWORD value to 1 o o Requires the user to provide logon credentials for Lync rather than automatically using Windows credentials during sign-in to a SIP server. verify namespace is federated: o Collect the Realm Discovery XML document: The NameSpaceType attribute should be "Federated". If it is set to managed, they aren't using Federated Auth o Three lines from this UserRealm document are of interest for diagnosing ADFS issues. Copy them each into an IE window and review their output: <AuthURL>: 4

5 1. This should return either a sign-on page, or a page with "An error occurred" from ADFS, but not an IE error like "Page cannot be displayed." This is the URL that Portal/OWA login is redirected to. 2. <STSAuthURL> </STSAuthURL> This should return an "HTTP 400" error. The presence of this error is NOT indicative of an issue. Other errors do indicate an issue. This is the URL that Exchange Online will hit 5

6 3. <MEXURL> ADFS Endpoint>/adfs/services/trust/mex </MEXURL> this should return an extensive XML document. This is the endpoint that O365 will try to hit in order to pull any potential policy/cert updates from the Auth Provider. Federation Metadata - Test the IDP Initiated SignOn URL (Use the same endpoint you identified in Step 3) This should return a sign-on page If any of these tests return abnormal responses, engage the Identity team for assistance with ADFS. The following details will be helpful to collect while pending Identity team resource. What version of ADFS is the customer using? How many ADFS servers, and ADFS Proxy servers is the customer using? Are they load balanced? Has the customer implemented a Client Access Policy? Is the customer using TMG? Can the customer log on to the portal? [ Collect a fiddler trace of the attempt If you are receiving 503's, a reboot of ADFS and/or the proxy may be in order 6

7 ADFS This will more than likely be the most common you will see. This is default ADFS 3.0 with no customization: 7

8 This will more than likely be the most common you will see. This will generally have the same look and feel, tenant admins can make changes to this if they are so inclined, you can see how we have customized it internally at Microsoft. Notice Multi Factor Auth (MFA) being an option as well as the customized branding. Default URL's for ADFS: <State>1</State> <UserState>2</UserState> <NameSpaceType>Federated</NameSpaceType> <DomainName>LABME.CO</DomainName> <FederationGlobalVersion>-1</FederationGlobalVersion> <AuthURL> <IsFederatedNS>true</IsFederatedNS> <STSAuthURL> <FederationTier>0</FederationTier> <FederationBrandName>LABME.CO</FederationBrandName> <AllowFedUsersWLIDSignIn>false</AllowFedUsersWLIDSignIn> <Certificate>CERTSTRING</Certificate> <MEXURL> <SAML_AuthURL/> <PreferredProtocol>1</PreferredProtocol> <EDUDomainFlags>0</EDUDomainFlags> 8

9 OKTA Okta is a popular 3rd party auth provider, which we do support handing auth for us, however, we don t support deep dive troubleshooting. If you determine that there are authentication issues, you should have the customer engage that team. 9

10 Ping Ping is similar to Okta - another 3rd party Auth provider. We support having them provide the signed tokens, however, we don t deep dive troubleshoot. 10