SIM402

Kerberos, NTLM, Basic, Digest, Forms?

Federation of Identity

Identity Provider (IP) Active Directory Security Token Service (STS) User / Subject /Principal Requests token for AppX Issues Security Token crafted for Appx Relying party (RP)/ Resource provider Issuer IP-STS Trusts the Security Token from the issuer The Security Token Contains claims about the user For example: Name Group membership User Principal Name (UPN) address of user address of manager Phone number Other attribute values Security Token “Authenticates” user to the application ST Signed by issuer AppX Authenticates user

demo

ADFS STS Claims-aware app Active Directory Browse app Not authenticated Redirected to STS Authenticate Our user Query for user attributes Return Security Token Return cookies and page Send Token App trusts STS ST

Process token Home realm discovery Redirected to partner STS requesting ST for partner user Return ST for consumption by your STS Return new ST Your ADFS STS Your Claims-aware app Active Directory Partner user Partner ADFS STS & IP Redirected to your STS Authenticate Send Token Return cookies and page Browse app Not authenticated Redirect to your STS ST App trusts STSYour STS trusts your partner’s STS

Communication A Signing Relying partyIssuer ST Encryption ST B Public key of C C Public key of D D Root for ARoot for B

Claims-aware application ADFS 2.0 Active Directory Define AD as claims provider APP1 Define STS1 as claims provider STS1 Define APP1 as Relying party

demo

AD Issuance Transform rules Issuance Authorization rules ST Acceptance Transform rules Relying Party Trusts Claims Provider Trusts Specify the users that are permitted to access the relying party Specify incoming claims that will be accepted from the claims provider and passed to the pipeline Permit: specifies claims that will be sent to the relying party Deny: Not processed Permit: specifies claims that will be sent to the relying party Deny: Not processed Claims Provider Trusts

Condition Issuance Statement

Claim Rule Language

demo

Claims Trust Relying Party x Relying Party Trust Claims Trust Your ADFS STS Partner ADFS STS & IP Relying Party Trust Partner organization Your organization

Partner user Client request token for access to relying party x Your Organization ADFS Claims Trust Relying Party Trust Relying Party x Processes Acceptance Transform Rules Processes Issuance Authorization Rules If allowed processes Issuance Rules ST Returns token for Relying Party x If denied Processing ends Security Token Service (STS) ST from Partner ST Trusted Partner ST

Process token Home realm discovery ST Redirected to partner STS requesting ST for partner user Return ST for consumption by your STS Return new ST ST Your ADFS STS Your Claims-aware app Active Directory Partner user Partner ADFS STS & IP Redirected to your STS ST Authenticate Send Token Return page and cookie Browse app Not authenticated Redirect to your STS

John has designed and implemented computing systems ranging from high-speed industrial controllers through to distributed IT systems with a focus on security and high-availability. A key player in many IT projects for industry leaders including Microsoft, the UK Government and multi-nationals that require optimized IT systems. Developed technical training courses that have been published worldwide, co-authored a highly successful book on Microsoft Active Directory Internals, presents regularly at major international conferences including, TechEd, IT Forum and European summits. John can be engaged as a consultant or booked for speaking engagements through XTSeminars.

Required Slide Speakers, please list the Breakout Sessions, Interactive Discussions, Labs, Demo Stations and Certification Exam that relate to your session. Also indicate when they can find you staffing in the TLC.

Sessions On-Demand & CommunityMicrosoft Certification & Training Resources Resources for IT ProfessionalsResources for Developers Connect. Share. Discuss.

Scan the Tag to evaluate this session now on myTechEd Mobile