I see that SSO is supported for Server-based Auth between SP 2016 On-Premise & Dynamics 365 On-Premise, as per Microsoft.
SSO actually works "in the domain" so I only type CRM credentials once to login (Forms based auth using ADFS) then I can open any SharePoint file without being asked for credentials again.
My issue is when user browse the CRM site through internet, he needs to login to CRM once (Forms auth), then type the credentials once again (pop-up window for credentials uses Windows Auth) when he clicks on any SP file within iFRAME through CRM.
Currently, SP site uses Claims-based auth with NTLM.
So, as a summary, over internet user have to type credentials once for CRM & once for SP files.
My question is can I have a full SSO experience over internet (type credentials only 1 time for CRM login)? and if so, what do I have to change?