2. Customizing and Extending ADFS 2.0 Brian Puhl Technology Architect Microsoft Corporation SIA318

4. Identity Provider Application Provider Application Federation Service Active Directory

5. Identity Provider Application Provider Application Federation Service Active Directory 1. User browses to application a. Anonymous landing page or automatic redirect?

6. Identity Provider Application Provider Application Federation Service Active Directory 1. User browses to application a. Anonymous landing page or automatic redirect? 2. Application redirects to federation service a. Home Realm Discovery

7. Identity Provider Application Provider Application Federation Service Active Directory 1. User browses to application a. Anonymous landing page or automatic redirect? 2. Application redirects to federation service a. Home Realm Discovery 3. Redirects to IdP Federation Service a. Sign-in against AD

8. Identity Provider Application Provider Application Federation Service Active Directory 1. User browses to application a. Anonymous landing page or automatic redirect? 2. Application redirects to federation service a. Home Realm Discovery 3. Redirects to IdP Federation Service a. Sign-in against AD 4. Redirects back to Federation services a. Claims provider trust rules b. Relying party rules

9. Identity Provider Application Provider Application Federation Service Active Directory 1. User browses to application a. Anonymous landing page or automatic redirect? 2. Application redirects to federation service a. Home Realm Discovery 3. Redirects to IdP Federation Service a. Sign-in against AD 4. Redirects back to Federation services a. Claims provider trust rules b. Relying party rules 5. Redirects to application

10. Application Federation Service Active Directory 1. User browses to application a. Anonymous landing page or automatic redirect?

11. Application Federation Service Active Directory 1. User browses to application a. Anonymous landing page or automatic redirect? 2. Application redirects to federation service a. Home Realm Discovery

12. Application Federation Service Active Directory 1. User browses to application a. Anonymous landing page or automatic redirect? 2. Application redirects to federation service a. Home Realm Discovery 3. Redirects to IdP Federation Service a. Sign-in against AD

13. Application Federation Service Active Directory 1. User browses to application a. Anonymous landing page or automatic redirect? 2. Application redirects to federation service a. Home Realm Discovery 3. Redirects to IdP Federation Service a. Sign-in against AD 4. Redirects back to Federation services a. Claims provider trust rules b. Relying party rules

14. Application Federation Service Active Directory 1. User browses to application a. Anonymous landing page or automatic redirect? 2. Application redirects to federation service a. Home Realm Discovery 3. Redirects to IdP Federation Service a. Sign-in against AD 4. Redirects back to Federation services a. Claims provider trust rules b. Relying party rules 5. Redirects to application

30. ASP.Net Page: HRD.aspx When service loads HRD.aspx page, check wtrealm and lookup HRD experience to display

31. ASP.Net Page: HRD.aspx ASP.Net User Control (.ascx) For each application which requires, convert their desired page from.aspx to.ascx and load into a full screen panel in the.aspx page Note the.aspx page needs a selectWHR method calling SelectHomeRealm()

36. Note that this team did not want all 4 HRD options to be displayed? That’s a problem…

40. dXJuOmZlZGVyYXRpb246TVNGVA== Base64 encoded value: urn:federation:MSFT This is the federation service identifier for the claims provider trust partner that the HRD cookie maps to

47. Claim TypeDescription X-MS-ProxyIndicates that a user was auth’ed by the FS-P X-MS-Forwarded-Client-IPIP address of the user. “Best effort”, IPv4 only. X-MS-Client-ApplicationProtocol used by the end client, e.g.: Microsoft.Exchange.ActiveSync Microsoft.Exchange.Powershell Microsoft.Exchange.SMTP X-MS-Client-User-AgentDevice type used by an EAS client, e.g.: Apple-iPad1C1/812.1 Apple-iPhone/704.11 SAMSUNGSPHD700/100.202 X-MS-Endpoint-Absolute-PathIndicates requested endpoint, active vs. passive

52. The default IE user experience does not render anything in the browser behind the credential pop- up

59. DOWNLOAD Windows Server 2012 Release Candidate microsoft.com/windowsserver #TE(sessioncode) DOWNLOAD Microsoft System Center 2012 Evaluation microsoft.com/systemcenter Hands-On Labs Talk to our Experts at the TLC

60. Connect. Share. Discuss. http://europe.msteched.com Learning Microsoft Certification & Training Resources www.microsoft.com/learning TechNet Resources for IT Professionals http://microsoft.com/technet Resources for Developers http://microsoft.com/msdn

61. Evaluations http://europe.msteched.com/sessions Submit your evals online