Federated ID: How can we tell Acrobat DC to sign users in automatically? (SSO)

Report · Dec 06, 2018

We recently deployed Federated ID with ADFS for our enterprise Acrobat DC subscription. That part is working fine, but now that we're planning our deployment, we seem to be missing a step to get the seamless SSO experience we have with other software we use.

How can we tell Acrobat to automatically sign the user in? Right now, when the user opens Acrobat the first time, they're asked to sign in, click "sign in with an enterprise ID", type their email address, etc. before they can actually use the SSO piece.

Our users log on to their PCs with the same identity the federated ID will use. Is there a registry key or deployment option we can set that will attempt to sign in with the logged in user's identity? We're trying to make this as seamless as possible for our users.

Report · Jan 29, 2019

Did you ever get an answer to this question AndrewC88 ? We're facing the same.

In Response To walkerm15352597 · Jan 30, 2019

Hi,

This can be done, although settings are on the IDP side not the Adobe side. For ADFS try the following.

Caveats are that users need to be logged in as a domain user. It does not work for non-domain joined machines and not when outside the network.

1. On your ADFS, verify the Authentication Policies. Set Form Based Authentication for Extranet and Windows Authentication for Intranet.

2. On your client, double check that you're logged in with a Windows Domain user. Also check the user has an Email address and the Email address has been added as a Federated ID to your Creative Cloud Console and has a product assigned to it.

3. On the client, open the "Internet Options" panel. Go to the Security tab and select Local Intranet and click Sites, then "advanced". Add your ADFS URL to the Sites list.

4. Still under "Local Intranet" and "Security Level for this zone", click "Custom Level" and scroll down to "User Authentication" and select "Automatic Login only in Intranet zone". Click Ok to close.

5. Under Internet Options, click the Advanced Tab and scroll down to "Security" and untick the box for "Enable Integrated Windows Authentication". Click ok and close all panels.

6. Close the browser and restart the client.

7. Log back in with your Domain user and browse to https://www.adobe.com or open the Creative Cloud Desktop application. Type in your Federated ID User's Email address and hit the tab key. The browser should now redirect to your ADFS URL and you should automatically be authenticated based on the domain user credentials. If you are attempting the login from a machine outside of your domain, you should be presented with the ADFS Login page.

In Response To alisterblack · Jan 30, 2019

Alister --

this is the behavior we already have.

I suppose the real question is: Can Adobe recognize the user's identity automatically? And if so, how is that configurable?

Thanks,

In Response To walkerm15352597 · Jan 31, 2019

Hi,

No this is purely handled on the IDP side not by the Adobe application.

In Response To alisterblack · Feb 13, 2019

Hi alisterblack,

As walkerm15352597 said, the behavior you describe in your reply above is how it works currently. The IDP part of the process handles authentication as expected for us.

The part I'm trying to eliminate or automate is the part where the Adobe application wants users to click "sign in" and then enter their email address and click "Enterprise ID" to be passed off to the IDP.

There should be a way to detect that the logged in user has a federated ID and sign in that way without requiring user intervention. This is how it works for many of our other applications that support SSO (Microsoft Office, Zoom, ShareFile, etc.).

Some of the apps I've configured have a deployment, registry, or group policy setting to tell the application to log in using SSO automatically. I'm looking for something like that for our Adobe applications.

In Response To AndrewC88 · Feb 13, 2019

Following up on this as I eventually opened a ticket with Enterprise support. For federated logins Adobe only allows SA initiated single sign on, not IDP. Apparently it is a highly requested feature and is ''in development".

In Response To walkerm15352597 · Oct 04, 2019

This is disappointing. Has there been any progress on this ability?

In Response To walkerm15352597 · Oct 28, 2019

Is there any update to this request? We would like to provide a seamless SSO experience for our Acrobat users.

In Response To walkerm15352597 · May 05, 2020

any updates on this? we are looking to switch from classic to continous and this aspect is killing us. every other software we use lets us prepopulate users info and automate said process. i have even found a way to get current user first, last name, and email and can apply to registry but there are no keys to prepopulate said info and users still have to click enterprise id, type in email and then activate.

i plan to put a ticket into support also.

In Response To TheOldITDude · Nov 14, 2020

Is this still "in development"? Has anyone heard back from Adobe?

It should be as simple as hardcoding your domain name in the registry and then whenever the Adobe / Creative Cloud Desktop application opens and prompts for authentication, it would read the "domain" key from the registry and automatically bypass that first screen which prompts users to "Type in your Federated ID User's Email address and hit the tab key"; it would just immediately go to the IDP URL (and since we have SSO on our IDP, there would be absolutely no input needed from the end user.

In Response To Andrew5EA4 · Jan 28, 2021

Indeed, highly anticipated future.

In Response To alisterblack · Feb 17, 2022

Is there at least a way to restrict sign in to only a Federated ID login? As it is there is nothing to prevent users from utilizing Adobe IDs for sign in resulting in licensing issues.

In Response To alisterblack · Oct 03, 2023

It is near the end of 2023 and there still seems to be no implementation of this.

In Response To Colby32689405u3db · Oct 03, 2023

most enterprise & teams admins make adobe suggestions in the cc desktop ideas forum.

Report · Nov 15, 2023

After much searching this week, I've also concluded that Seamless SSO is simply unsupported with Adobe Enterprise - SSO works fine as described above, but Seamless (no need to enter username) is not a thing yet. I did wonder whether anyone has tried with OIDC (rather than SAML) but without a test tenant I'd have to remove my live configuration to try it - if you've tried and can confirm it does (or doesn't) work that'd be greatly appreciated.
After four years of community requests, Adobe, might it be time to look at this one?