Active Directory Federation Services - Revision history

Karl Jones: /* External links */

2016-04-25T10:40:49Z

‎External links

Karl Jones at 00:30, 16 April 2016

2016-04-16T00:30:36Z

Karl Jones at 17:41, 28 September 2015

2015-09-28T17:41:10Z

Karl Jones: Created page with "..."

2015-09-28T17:23:12Z

Created page with "..."

New page

...

@@ Line 44: / Line 44: @@
 * [https://en.wikipedia.org/wiki/Active_Directory_Federation_Services Active Directory Federation Services] @ Wikipedia
 [[Category:Information security]]
 [[Category:Internet security]]
 [[Category:Microsoft]]
 [[Category:Web design and development]]

@@ Line 1: / Line 1: @@
-'''Active Directory Federation Services''' ('''ADFS''') is a software component developed by Microsoft that can be installed on Windows Server operating systems to provide users with [[single sign-on]] access to systems and applications located across organizational boundaries.
+'''Active Directory Federation Services''' ('''ADFS''') is a software component developed by [[Microsoft]] that can be installed on Windows Server operating systems to provide users with [[single sign-on]] access to systems and applications located across organizational boundaries.
 == Description ==
@@ Line 35: / Line 35: @@
 * [[Computer security]]
 * [[Internet Security]]
 * [[Security Assertion Markup Language]](SAML)
@@ Line 41: / Line 43: @@
 * [https://en.wikipedia.org/wiki/Active_Directory_Federation_Services Active Directory Federation Services] @ Wikipedia

← Older revision		Revision as of 17:41, 28 September 2015
Line 1:		Line 1:
−	...	+	'''Active Directory Federation Services''' ('''ADFS''') is a software component developed by Microsoft that can be installed on Windows Server operating systems to provide users with [[single sign-on]] access to systems and applications located across organizational boundaries.
		+
		+	== Description ==
		+
		+	It uses a claims-based access control authorization model to maintain application security and implement [[federated identity]].
		+
		+	Claims-based authentication is the process of authenticating a user based on a set of claims about its identity contained in a trusted token. Such a token is often issued and signed by an entity that is able to authenticate the user by other means, and that is trusted by the entity doing the claims-based authentication.
		+
		+	== Establishing trust between two security realms ==
		+
		+	In ADFS, identity federation is established between two organizations by establishing trust between two [[Security realm\|security realms]].
		+
		+	=== Federation server (Accounts side) ===
		+
		+	A [[federation server]] on one side (the Accounts side) authenticates the user through the standard means in Active Directory Domain Services and then issues a token containing a series of claims about the user, including its identity.
		+
		+	=== Federation server (Resources side) ===
		+
		+	On the other side, the Resources side, another federation server validates the token and issues another token for the local servers to accept the claimed identity.
		+
		+	This allows a system to provide controlled access to its resources or services to a user that belongs to another security realm without requiring the user to authenticate directly to the system and without the two systems sharing a database of user identities or passwords.
		+
		+	== User perception in practice ==
		+
		+	In practice this approach is typically perceived by the user as follows:
		+
		+	* The user logs into their local PC (as they typically would when commencing work in the morning)
		+	* The user needs to obtain information on a partner company's extranet website - for example to obtain pricing or product details
		+	* The user navigates to the partner company extranet site - for example: http://example.com
		+	* The partner website now does not require any password to be typed in - instead, the user credentials are passed to the partner extranet site using AD FS
		+	* The user is now logged into the partner website and can interact with the website 'logged in'
		+	* ADFS integrates with Active Directory Domain Services, using it as an identity provider. ADFS can interact with other WS-* and SAML 2.0 compliant federation services as federation partners.
		+
		+	== See also ==
		+
		+	* [[Computer security]]
		+	* [[Internet Security]]
		+	* [[Security Assertion Markup Language]](SAML)
		+
		+	== External links ==
		+
		+	* [https://en.wikipedia.org/wiki/Active_Directory_Federation_Services Active Directory Federation Services] @ Wikipedia