Office 2016 client application not presented with ADFS Home Realm Discovery
ADFS 2016 (resource domain) with federated ADFS 2016 partner (user domain). Both ADFS environments are published with a Web Application Proxy residing in the same DMZ. When using a browser, and navigating to a site within the sharepoint environment (externally), we're prompted with the ADFS authentication chooser page (presented from the Resource ADFS). This allows us to choose whether to login using User domain credentials or Resource domain credentials. When we use an Office 2016 client application, however, we are not presented with the authentication chooser page, we're only presented with the Resource login form. This is unexpected and naturally prevents anyone from the User domain from being able to authenticate and thus can't open a file. I haven't been able to find any references online for this issue, so any help would be greatly appreciated. Trevor Seward UPDATE-1: Additional info... compared fiddler capture on what should be a very similar conversation between browser accessing/authenticating/authorizing to SharePoint (on-premise) versus office client application accessing/authenticating/authorizing to SharePoint. The Office application capture presents a FedAuth cookie and all items in the header I would expect. The response it gets back includes: X-Forms-Based_Auth_Required: [adfs URI] ... at the end of this URL i see a parameter 'context=MSOFBA' However when I look at the browser capture, I'm seeing 'RedirectToIdentityProvider=[url for User domain ADFS]. So I'm assuming SharePoint intuitively holds a trust token for a UserDomain user via it's claims. Trusted by SharePoint because it trusts it's own Resourcedomain ADFS. However, Office2016 client application has no such relationship and all it gets from SharePoint is "you need to go over here to authenticate which is to the same-domain ADFS login form page"? Similarly, if i use a browser to go to "https://namespace.com/sites/site/Shared%20Documents/?context=MSOFBA" ... I get sent to a provider chooser... If i choose ADFS, i then get the ADFS Authentication Chooser which is what I need the Office 2016 client application to do... UPDATE-2: (Perhaps this is more of an ADFS response question) I had a chance to read through a fair amount of the Microsoft online documentation on MS-OFBA. From what I understand, the Office 2016 client application is abiding by the MS-OFBA protocol by including specific options in the Request header. Additionally, ADFS also appears to be responding properly with Response headers: * X-Forms_Based_Auth_Required: [parameterized URI] * X-Forms_Based_Auth_Return_Url: [URL to web application] So the biggest question I haven't been able to find an answer to is: How do we force ADFS to present the ADFS Home Realm Discovery (HRD) page (When Office 2016 client app authenticates) instead of automatically displaying the 'local' Active Directory provider login? I have found some potential in modifying the ADFS onload.js, but am not sure this is the right path. --to be continued--