I have a client who's users use a common account to log into windows, they then access SharePoint 2010 and authenticate via their AD credentials. They access Outlook Web Apps via a page that has an iframe to the OWA site. Is it possible for their AD credentials they used for SharePoint auth to be passed to OWA so they do not have to authenticate twice?

  • Mike, Do you have the steps on how we can pass the claims to OWA?
    – user16217
    Apr 9, 2013 at 12:16

2 Answers 2


If you are going to use a common account that is different than the user's individual account then you may want to consider setting up something that can support Single Sign On. One example would be setting up the system for Claims with an ADFS provider. The claim can persist and be used to authenticate the users to OWA. A second option would be to use something like Microsoft TMG or UAG which can also provide Single Sign-On capabilities.

Updated with resource links

Configure SharePoint 2010 for ADFS http://blogs.technet.com/b/speschka/archive/2010/07/30/configuring-sharepoint-2010-and-adfs-v2-end-to-end.aspx

Access OWA with ADFS http://www.theidentityguy.com/articles/2010/10/15/access-owa-with-adfs.html?currentPage=2

  • Do you have an example on how to pass the claims to OWA? Apr 9, 2013 at 14:24
  • @TalonMcShay My understanding is that if both systems/web applications are setup to support ADFS and the same authentication source they are allowed to share the claim passed to the client computer. My team recently did a project that provided Single Sign-On between SP 2013 and SAP using this method. Apr 9, 2013 at 14:37
  • DHeepa B - See the updated answer. Apr 9, 2013 at 14:40
  • Thank you for your suggestion. Since it is all in house servers for the client, we are leaning towards Claims/Kerberos and have passed the suggestions to the client. Apr 9, 2013 at 15:10

It sounds to be me like the Kerberos to be one way to achieve this quickly, but not entirely maybe. So you would need to configure Kerberos for your farm and AD domain. Find examples and walkthrough : http://technet.microsoft.com/en-us/library/gg502599(v=office.14).aspx or http://blog.blksthl.com/2012/09/26/the-final-kerberos-guide-for-sharepoint-technicians/

Furthermore (as Mike also proposes) another mechanism could be ADFS, (to my knowledge OWA is not claims aware therefore it would be impossible to pass-it on further).

  • If they are logging into windows with a common account as the first sentence says, then kerberos would pass the common account and not the individual account. Apr 8, 2013 at 20:31
  • Mike, yes you are absolutely right, at first it will (only if IE is also configured as such), however as soon as they shall re-login with new AD - those should be passed further to the iFrame Apr 8, 2013 at 21:03
  • I stand corrected. While I have worked extensively with Kerberos, I have not worked in a scenario where the credentials for the logged in user are different than what is logged into the computer. At its root though, Kerberos is about delegation to the next party so that makes sense. Apr 8, 2013 at 21:08
  • @C.Marius Thank you for your suggestion. I've forwarded the option to my client. Apr 9, 2013 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.