Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have a client who's users use a common account to log into windows, they then access SharePoint 2010 and authenticate via their AD credentials. They access Outlook Web Apps via a page that has an iframe to the OWA site. Is it possible for their AD credentials they used for SharePoint auth to be passed to OWA so they do not have to authenticate twice?

share|improve this question
    
Mike, Do you have the steps on how we can pass the claims to OWA? –  user16217 Apr 9 '13 at 12:16

2 Answers 2

If you are going to use a common account that is different than the user's individual account then you may want to consider setting up something that can support Single Sign On. One example would be setting up the system for Claims with an ADFS provider. The claim can persist and be used to authenticate the users to OWA. A second option would be to use something like Microsoft TMG or UAG which can also provide Single Sign-On capabilities.

Updated with resource links

Configure SharePoint 2010 for ADFS http://blogs.technet.com/b/speschka/archive/2010/07/30/configuring-sharepoint-2010-and-adfs-v2-end-to-end.aspx

Access OWA with ADFS http://www.theidentityguy.com/articles/2010/10/15/access-owa-with-adfs.html?currentPage=2

share|improve this answer
    
Do you have an example on how to pass the claims to OWA? –  TalonMcShay Apr 9 '13 at 14:24
    
@TalonMcShay My understanding is that if both systems/web applications are setup to support ADFS and the same authentication source they are allowed to share the claim passed to the client computer. My team recently did a project that provided Single Sign-On between SP 2013 and SAP using this method. –  Mike Oryszak Apr 9 '13 at 14:37
    
DHeepa B - See the updated answer. –  Mike Oryszak Apr 9 '13 at 14:40
    
Thank you for your suggestion. Since it is all in house servers for the client, we are leaning towards Claims/Kerberos and have passed the suggestions to the client. –  TalonMcShay Apr 9 '13 at 15:10

It sounds to be me like the Kerberos to be one way to achieve this quickly, but not entirely maybe. So you would need to configure Kerberos for your farm and AD domain. Find examples and walkthrough : http://technet.microsoft.com/en-us/library/gg502599(v=office.14).aspx or http://blog.blksthl.com/2012/09/26/the-final-kerberos-guide-for-sharepoint-technicians/

Furthermore (as Mike also proposes) another mechanism could be ADFS, (to my knowledge OWA is not claims aware therefore it would be impossible to pass-it on further).

share|improve this answer
    
If they are logging into windows with a common account as the first sentence says, then kerberos would pass the common account and not the individual account. –  Mike Oryszak Apr 8 '13 at 20:31
    
Mike, yes you are absolutely right, at first it will (only if IE is also configured as such), however as soon as they shall re-login with new AD - those should be passed further to the iFrame –  C. Marius - MVP Apr 8 '13 at 21:03
    
I stand corrected. While I have worked extensively with Kerberos, I have not worked in a scenario where the credentials for the logged in user are different than what is logged into the computer. At its root though, Kerberos is about delegation to the next party so that makes sense. –  Mike Oryszak Apr 8 '13 at 21:08
    
@C.Marius Thank you for your suggestion. I've forwarded the option to my client. –  TalonMcShay Apr 9 '13 at 15:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.