Managing user access in businesses today is something like playing traffic cop in an intersection of a thousand roads. From Web-based applications to homegrown programs, from desktop PCs to the latest crop of smartphones, IT has to be able to control access to every sort of resource while allowing users to access them from anywhere and any platform.

Microsoft has updated Active Directory Federation Services (ADFS) to aid IT in applying identity management across domains and business boundaries. Both of these tools are intended to extend user access control across the enterprise; FIM uses a common platform to tie user, certificate, group, and policy management together, while ADFS provides trust accounts between different networks or organisations. Together, they provide a powerful platform for extending user management beyond the company domain or network edge.

Active Directory Federation Services, first available in Windows Server 2003, is now a server role in Windows Server 2008 R2. ADFS is a single-sign-on technology that uses claims-based authentication to validate a user's identity across domains. Normally when the user's account is in one domain and the resource is in another, the resource will prompt the user for local credentials. ADFS eliminates the secondary credential request; the user's identity is validated, and access provided, based on information in the user's home directory.

Through the use of ADFS, it is possible to facilitate a wide range of managed access. It makes it easy for users to access an Internet-accessible application on another company's network or to allow outside contractors access to internal resources for the duration of a specific project. The key advantage is that neither domain need contain any of the other domain's user information; no user information is shared, and each side remains responsible only for its own user management.

A claims-based system, like many others, uses digital tokens that contain information about the user. But unlike a request made directly against Active Directory and generating a Kerberos token, the resource being accessed doesn't interact directly with the user data store. Instead, it talks to a Security Token Service, such as ADFS, which performs the check against the user information store and creates a claims token based on the result of the lookup. The claims token can contain as much -- or as little -- information as needed to access the particular service.

Using claims-based authentication between two different domains requires a Security Token Service in each domain. Each domain's Security Token Service must trust the other one, and based on this trust, a policy is defined that specifies if access is granted or denied to a specific resource. For example, when a user on Network A attempts to access a Web portal on Network B, an authentication request is made to the user's Security Token Service on Network A. After validating the claims for the user against the local user directory, Network A's Security Token Service provides a token to Network B's Security Token Service, which then issues its own token to the requesting user in order to access the Web portal. There is a lot of back and forth behind the scenes, but once the remote domain gets the all-clear from the user's Security Token Service, the user gets a new token as if they were a member of the remote domain.

Within a single domain - such as when you want to extend user access to a cloud service without implementing a direct authentication connection to Active Directory or another user database - a single Security Token Service will do the job. In addition to supporting claims-aware ASP.Net applications and (through an IIS Web server agent) Windows NT token-based applications on the resource side, ADFS 2.0 can communicate with third-party federation services and cloud services using SAML 2.0.

The great advantage of claims-based authentication - and ADFS 2.0 - is that no changes are made to either domain's users and no confidential information is sent between domains. When a claims-based request is made from the resource, it simply performs an "is allowed?" request against the issuing claims server. The claim token returns a Yes or No response regarding the user and nothing more. This gets the application out of the user authentication business. It simply asks a trusted partner if it is OK to allow this person to access its resources. All the heavy lifting is done behind the scenes.

ADFS 2.0: Federation services and user claims

 There are three role services that make up ADFS: the Federation Service, the Federation Service Proxy, and the Web server agent. The Federation Service is the core of ADFS; it's the part of the system that handles user authentication requests from other federation servers. The Federation Service Proxy runs on a server located in the network's DMZ and proxies an external user authentication request to an internal ADFS server. It collects user credentials from browser clients and sends them on to the ADFS server. The Web proxy agent works with claims-aware (ASP.Net) applications on a website and redirects user login requests to the ADFS server. The Federation Service Proxy and the Web agent are optional and may not be needed in all scenarios.

Microsoft ADFS 2010

Active Directory Federation Services 2.0 provides an extensible platform for handling claims-based authorization between local and remote domains. Here we see a list of the claims offered by the ADFS server to any other trusted Security Token Service provider. Each trust can have a different set of claims associated with it, allowing ADFS to fit in any situation.

To get started with ADFS, make sure you have a valid SSL certificate (self-signed is sufficient but not recommended for a production environment), Windows Server 2008 R2, Microsoft SQL Server 2008 (for the policy store), and Active Directory Domain Services. The ADFS 2.0 software is available as a free download from Microsoft through the Download Center.

Setting up ADFS takes quite a few steps, most of which involve importing the SSL certificate, exporting certificates, and creating shared certificates. Each ADFS server has to import the other's SSL certificate in order to authenticate the external lookup request. The end result is that a trust relationship between the two federation servers (Security Token Services) is established using SOAP messages and SAML metadata. The last step is generating the claims rules appropriate for the exposed resource.

Claims rules can come in many forms and vary greatly based on the target resource or application. For the most part, each rule or policy must know the Uniform Resource Identifier (URI) of the application, which claims are being offered, which claims the application requires, the URL the application should expose to the user, and finally, if the token should be encrypted or not. Some rules might require user name, email address, and group affiliation, while others may only need first and last name. Rules can simply pass information through to ADFS or transform the data into something recognisable. For example, if ADFS talks to an LDAP server, it might need to reformat the user name so that the other ADFS (or Security Token Service) can properly process it. ADFS provides a very flexible rule engine that can handle most every situation.


Active Directory Federation Services is a great way to extend trusted authenticated access between domains using claims-based authentication. The fact that it works with other open Web standards allows it to extend its reach into non-Microsoft domains, while still allowing trusted access and single-sign-on capabilities. It does require a little work to get set up, but once in place, the benefits really pay off.