1. Module 11: Designing an Active Directory Federation Services Implementation in Windows Server 2008

2. Module Overview Overview of an Active Directory Federation Services Design Designing a Business-to-Business Federation Designing Active Directory Federation Services Claims and Applications

3. Key Components of ADFS AD FS includes the following components: Account Federation server Account Federation server proxy Resource Federation server Resource Federation server proxy AD FS Web Server Agent AD DS Domain Controllers

4. ADFS Server Roles ADFS server role includes following components: Federation Service Federation Service proxy Claims-aware agent Windows token-based agent

5. ADFS Server Placement When determining your ADFS server placement, consider: Where to place a federation server? Where to place a federation server proxy? Federation Server AD DS Federation Server Proxy PERIMETER NETWORK INTRANET FOREST

6. Components of a B2B Federation Trust Account Partner Organization Resource Partner Organization Resource Federation Server Account Federation Server AD DS AD FS- enabled Web Server Federation Trust

7. Guidelines for Deploying and Securing ADFS Servers When deploying AD FS servers that are servicing external clients: Place federation servers in front of a firewall and connect them to the corporate network to prevent exposure from the Internet Avoid having your federation servers directly accessible on the Internet Place a federation server proxy in the perimeter network before you configure your firewall servers for use with AD FS Use ISA Server 2006 publishing Consider deploying a federation server proxy in your organization's perimeter network when you want to: Prevent direct access to federation servers by external clients Differentiate the Internet user sign-in experience from that of corporate network users Create at least one AD FS-enabled Web server in the resource partner organization when you deploy any of the following AD FS designs: Web SSO Federated Web SSO Federated Web SSO with Forest Trust

8. Guidelines for Usage of Token-based and Claims- aware Applications When implementing applications using ADFS, consider: For a claims-aware application, ensure that the return URL is typed correctly in the application’s Web.config file Verify that ASP.NET is installed and enabled For a Windows NT token–based application, verify that the return URL is typed correctly in the ADFS Web Agent tab of IIS For a Windows NT token–based application, configure a resource account in the resource partner’s directory store