Office file not working for federated authenticated sites in SharePoint (SAML authentication).

 Situation

After implementing “iTrust” – SAML authentication while creating external facing sites(DMZ Area) – office files didn’t work.

 

Task/Analysis

Microsoft Office 2016 clients use modern authentication by default. In certain configurations, modern authentication isn’t supported by the Office 2016 clients with SharePoint Server 2016, such as when it is used for Active Directory Federation Services (AD FS) 3.0 installations. SharePoint administrators can now configure SharePoint Server 2016 to suppress modern authentication in Office 2016 clients.

 

Action

To configure SharePoint Server 2016 to suppress modern authentication in Office 2016 clients, follow these steps to run Microsoft PowerShell commands in the SharePoint 2016 Management Shell:

 

When you install SharePoint Server 2016, the user account from which you ran the installation is granted the appropriate permissions to run Microsoft PowerShell cmdlets. If any users have not been added to run a Microsoft PowerShell cmdlet, you can use the Add-SPShellAdmin cmdlet to add them. Before you can use the Add-SPShellAdmin cmdlet to grant permissions, verify that you meet all the following requirements:

 

You must have membership in the securityadmin fixed server role on the SQL Server instance.

 

You must have membership in the db_owner fixed database role on all databases that are to be updated.

 

You must be a member of the Administrators group on the server on which you are running the Microsoft PowerShell cmdlet.

 

At the SharePoint 2016 Management Shell command prompt, type the following commands:

 

$sts = Get-SPSecurityTokenServiceConfig

$sts.SuppressModernAuthForOfficeClients = $true

$sts.Update()

 

Restart Internet Information Services (IIS). To do this, run the following command:

 

iisreset /restart

 

Restart the SharePoint Timer Service (SPTimerV4). To do this, run the following commands:

 

Net Stop SPTimerV4

Net Start SPTimerV4

 

Run the following commands to verify that the change is made:

 

$sts = Get-SPSecurityTokenServiceConfig

$sts.SuppressModernAuthForOfficeClients

 

The last command should return True.

 

Result:

Office files started rendering on the browser.