Sharepoint 2013 + ADFS/WAP and MS Office

Question

I am hoping someone can answer a behavior question with SharePoint+ADFS/WAP. I can't find a definite answer but hopefully someone has the same environment as my client

My client has the following setup - Sharepoint 2013 on premise farm where users login internally via Kerberos i believe, basically no authentication prompts when on the network Externally, we have setup ADFS 3.0 + WAP, so that all requests externally go via the WAP server and forms based authentication prompts users to login (followed this article, http://www.brightstarr.com/sharepoint-technology-and-application-insights/securely-publishing-sharepoint-externally-using-web-application-proxy-part-2)

This works fine, logins work perfectly. However when opening any MS Office documents, word or excel, users are presented the same WAP login screen to authenticate again inside MS Office (2013 or 2016). Is the expected behaviour? I would have thought that some token would have passed through from the browser and the document could be opened with a single click

Hope someone can help

Thanks

Shaun

Answer 1

I ran into this as well for a client. It seems there is a hotfix for WAP. http://support.microsoft.com/kb/3020813

Install that, then run a PS command to set your time for "persistent cookies".

Get-WebApplicationProxyApplication yoursite.domain.com | Set-WebApplicationProxyApplication -PersistentAccessCookieExpirationTimeSec 3600

Answer 2

This is expected behavior as Office does not share the cookie/token with the browser (IE, Chrome, or Firefox).