MSDN Magazine - December 2007 - (Page 87) Jack Couch Security Authenticate Users Across Organizations Using ADFS ctive Directory® Federation Services (ADFS) was introduced in Windows Server® 2003 for organizations that need to participate in standards-based identity federation. With ADFS, you can more easily validate identity data from other organizations, leading to greater interoperability with your partners. In this article, I’ll take you on a guided tour of ADFS in action, using the experiences of a fictitious online service provider (A. Datum Corporation) that uses ADFS to interact with a real online service provider (UnderMyControl.com) and a fictitious customer (Tailspin Toys). or Active Directory) to authenticate users. An ADFS server acting as a resource partner is configured to support ADFS-aware applications. In this scenario, the ADFS server provides access both to the applications and to the account store. By using ADAM in conjunction with ADFS, you can enable single sign-on (SSO) so that customers don’t have to remember a multitude of passwords. Figure 1 shows how A. Datum deployed this solution in its organization. This article is based in part on a prerelease version of Windows Live ID. Details herein are subject to change. Using ADFS for SSO in a Single Organization The A. Datum Corporation is an online service provider that offers two Web applications to consumers. The first Web application enables online document sharing and storage; the second provides online music publishing for independent artists. Rather than using two separate account stores, which would require users to keep track of user names and passwords for each application, A. Datum used ADFS and ADAM (Active Directory Application Mode) to create a single account store, which enables users to access both applications using a single user name and password. In many situations, an ADFS server will act as either an account partner or a resource partner. An ADFS server acting as an account partner is configured to interact with an account store (either ADAM This article uses the following technologies: ADFS, ADAM This article discusses: Using ADFS for SSO in a single organization Configuring ADFS on the server and client ✥ Connecting to an external organization ✥ Expanding trust further with ADFS ✥ ✥ Jack Couch started his career in military intelligence and spent the past decade providing information security expertise to high-security government agencies and Fortune 500 companies. Recently, Jack was the Security Release Manager for Microsoft Windows Vista. He is currently the Managing Partner at DeepIntel, a security consulting firm dedicated to improving the security of large organizations. Jack can be contacted at jack@deepintel.com. december2007 87
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.