Using ASG Client from AADJ device with federated accounts to existing Onprem DB

[ASMahler]

Hi,
we started to use Azure AD only joined devices with federated AD users in the cloud.
For a SSO user expierience we implemented Kerberos for users --> How SSO to on-premises resources works on Azure AD joined devices | Microsoft Docs
The client software could successfully installed, so no issue here, including the SQL connection, ... passed the connection test :-)
When trying to connect with login type "Windows Account" and "integrated" feature we get an error.

In the second error message I can see that the client software using the current known user SID that is different to the AD onprem SID.
(... could be validated with "whoami /user" ... shows the Domain\account name and the "Azure ObjectID - SID" (S-1-12-1....)
Is there a possible workaround?
Maybe newer versions using the Kerberos Token directly?
Any other idea or suggestion?

Thx in advance
ASM

[DevOma]

I think you have to add your Azure AD to the "Domains" in Settings-Domains - then you can choose Accounts/Groups from that Domain in Permissions

[ASMahler]

I think you have to add your Azure AD to the "Domains" in Settings-Domains - then you can choose Accounts/Groups from that Domain in Permissions

When I talk about Azure AD i doesn´t mean a classic onprem active directory, it is the azure active directory in the Micrsosoft Cloud.
The computers are not joined into the classic domain, only to the cloud. The users still have a valid kerberos ticket for authentficiation.
But the ASG-RD client isn´t using it.

[DevOma]

Ok - then I can put it on the feature list to support this scenario in the future

[ASMahler]

Ok - then I can put it on the feature list to support this scenario in the future

okay understand, the scenario is currently not supported

Thanks for the clarification

[DevOma]

But did you try to add the Azure domain to "Domains" in Settings? Perhaps you can't use "Integrated" login - but it should be possible to authenticate against the Azure AD - just select or type the domain in login dialog and username / password - then it should work or not?

[ASMahler]

But did you try to add the Azure domain to "Domains" in Settings? Perhaps you can't use "Integrated" login - but it should be possible to authenticate against the Azure AD - just select or type the domain in login dialog and username / password - then it should work or not?

Okay, not yet, we will give them a try tomorrow
and provide feedback

[NT1848]

I would like to revive this post. We too use an AzureAD join for mobile workstations and are therefore not in a local domain.... when connecting to the local windows account ASG shows me my PC name.... here it would be great if ASG would support SSO to log in with my domain account, as it is annoying to enter a long PW every time.

Thanks in advance, i really hope for implementation of that feature

[DevOma]

I do not really understand where you have to type your password or where you want to have SSO?!?

[NT1848]

I do not really understand where you have to type your password or where you want to have SSO?!?

When i start ASG Remote Desktop App, then i log in to the Database Server. 

I normally do this with the Checkbox "Integrated". When i tick the "Integrated" Box on startup, ASG tries to use my local PC Name as my Domain.

I can only log into ASG, when i uncheck this box and type in my username and password and manually type in the domain. This is because of AzureAD Integration on my Laptop. 

We would need a capability for ASG to recognize a AzureAD Device and add the domain to the login form...

[DevOma]

Ok understand - let me check how it is handled and then we try to optimize...

[NT1848]

Ok understand - let me check how it is handled and then we try to optimize...

Thank you, i'll wait for a reply 

[to7K5RLZGwnR8U]

Ok understand - let me check how it is handled and then we try to optimize...

Any news? I'm having the same issue.

[DevOma]

We try to implement better integration for the next release...

[to7K5RLZGwnR8U]

We try to implement better integration for the next release...

Hi Oliver

Great news. When will that release be available? Is there a preview version out yet?

[DevOma]

Planned for Mid/End of March - no preview currently