Part III
做完對上兩邊Config，係時間測試下成果。
首先係去 “https://mydomain.facebook.com”
WorkPlace login page 顯示 “Your company has enabled single sign-on.”
變成冇得係到用”UserName/Password” Auth
“User Name / Password” vs “SSO”
當噉”Log In” 就會Redirect 去Azure嘅Login Page （第一步成功）
之後就變成同Office365 Login 一樣，需要用 AD Credentail / Client Certificate 做 Auth
係已經Join Domain嘅PC。因為有Kerberos Auth，當Page redirect去到Azure Login,只需要打Username (UPN)，往後嘅login process就會用Kerberos 完成
Part II
續Part I。Work Place Subdomain 準備就絮～開始戲肉。SAML Config。 如SalesForce一樣，大路嘅Idp（ADFS / Azure AD /G Suite / OKTA / One Login / Ping Identity)都有article講點做。基於Domain 已經係 Azure AD 上面Federated，亦即係同Office365 一樣， 會返ADFS Server 做Auth / MFA。 所以係唔需要考慮ADFS 個article 點做。
SAML configuration 唔難。基本都係兩邊資料 Copy n Paste。 但係最鑊，最怕就係兩邊各自各描述。Field名唔知邊個對邊個。
今次都係，先Configure 係Azure AD，First Try照跟Article係唔夠Parameters
大路照跟可以，但係留意以下Step3 >>>>>> 跟Azure咁做係誤以為夠。第一唔清楚咩係Identifier。跟Azure Article 咁做係唔夠，Sequence亦唔啱。 第一唔清楚咩係Identifier。。。。亦要Tick “Show advanced URL settings”嘅CheckBox
係要返WorkPlace， Dashboard，Authentication，係SAML Authentication 呢個Page 下面嘅Info
Azure “Identifier” = WorkPlace “Audience URL” >>> “https://www.facebook.com/company/15digitvalue”
Azure “Reply URL” = WorkPlace “ACS (Assertion Consumer Service) URL” >>> “https://domain.facebook.com/work/saml.php”
Confusing Sample from Azure
3. On the Workplace by Facebook Domain and URLs section, perform the following steps:
a. In the Sign-on URL textbox, type a URL using the following pattern: https://<instancename>.facebook.com
b. In the Identifier textbox, type a URL using the following pattern: https://www.facebook.com/company/<instancename>
係Azure做完上半，噉Save。 再Scroll Down落下面噉”Configure Workplace by Facebook”。 接落嚟嘅Information要放返落WorkPlace嘅Authentication Page。
WorkPlace呢邊係兩個URL相對容易啲啲，不係啲名都係唔match
Azure “Azure AD Single Sign-On Service URL” >>> WorkPlace “SAML URL”
Azure “Azure AD SAML Entity ID” >>> WorkPlace “SAML Issuer URI”
最後當然係Paste 返係Azure Download 嘅Signing Cert落去。 先去噉”Test SSO”。先會Pass 個Test Auth。
Cont’d @ Part III
Reference Link
https://developers.facebook.com/docs/workplace/authentication/sso
絕對唔係新野。 一兩年前記得叫Facbook for Work，但係搵唔到方法申請。機緣下 上星期睇到Azure 嘅article。
WorkPlace by FB要開Account唔難，去https://facebook.com/work 用Corporate Email account就開到。但就咁普通係做唔到任何Customization嘅（包括Authentication Integration)…….. e.g. “https://work-xxxxxxxx.facebook.com”
所以。。 第一件事係upgrade去Work Place Premium。 Procedure都係基本verify domain ownership。 一係Domain RootLevel 嘅Web Server Webpage放token，另一選擇就係DNS 落 TXT Record (後者絕對易做得多，但係估唔到FB Support話睇唔到我隻Domain host 係邊，唔講 TXT Record 個做法我知……玩野)
時間關係。。 兩日等左 DNS Record Creation 同往後FB嘅vertificaton，之後再需要等FB Subdoamin 由https://work-xxxxxxxx.facebook.com 變成我哋嘅 “https://mymdomain.facebook.com”
當Domain完全轉好（係會慢慢逐小逐小變出嚟，所以收左FB Email話Verification OK，最後都等左兩個鐘（封Mail講十分鐘OK….呃人）
Cont’d – Part II
Reference Link
https://developers.facebook.com/docs/workplace/authentication/sso
You must be logged in to post a comment.