Since the clients will be making these requests for authentication using the on-premises web service URL’s, you need to configure these web service URL’s as Service Principal Names (SPN’s) for your O365 tenant’s AAD SfB service application principal. Azure AAD needs to accept authentication requests from SfB clients.For SfB 2013 clients, a registry entry will be required please see. For SfB 2016 clients, this capability will be on by default. SfB clients support Modern Authentication.Set the Oauth configuration to use this server.The SfB server configured to send authentication requests to Azure AAD.
Support for HMA is included in SfB server May 2017 CU5 release, build.
Client gives access token to Exchange onlineīearing in mind the authentication flow, we need a few of things to make the Skype for Business authentication work:. AAD gives client access token to the Skype client. Exchange online redirects client to AAD. Exchange on-premises redirects client to Exchange online. 
If the user’s Exchange mailbox is online, then after step 16, the authentication flow will continue like this:
User logged in to SfB and SfB certificate issued to the client.Īfter the client signs in to SfB the Exchange Web Services authentication flow will start. Client gives client access token to SfB online. AAD gives client access token to SfB client. SfB on-premises validates the user and redirects user to online. If the user’s SfB account is online, then after step 8, the authentication flow will continue like this: Note that in an SfB hybrid configuration, all DNS records resolve to on-premises, therefore the authentication flow will always start there. In this scenario the user’s SfB and Exchange applications are on-premises and the user’s sip domain is Federated. Let’s take a look at a common sign on scenario for hybrid SfB. To understand what is needed for HMA to work, it’s helpful to understand the authentication flow. Overview of Authentication Flow with Skype for Business To learn more details on HMA, please take a pause and read Deep Dive: How Hybrid Authentication Really Works. This sets the foundation for you to leverage AAD security capabilities like two-factor authentication, or Intune Modern Application Management policies. Why would you want HMA? To enable SfB clients to obtain Access and Refresh Oauth tokens from AAD that SfB on-premises servers will accept and allow access. To use HMA with your SfB on-premises, you will need to have on-premises Active Directory federated with Azure Active Directory (AAD). #Skype for business mac preferences not working update
Skype for Business Server (SfB) 20 cumulative update supports Hybrid Modern Authentication (HMA).
0 kommentar(er)
