Active Directory Federation Services
{{short description|Microsoft software component}}
Active Directory Federation Services (ADFS), a software component developed by Microsoft, can run on Windows Server operating systems to provide users with single sign-on access to systems and applications located across organizational boundaries. It uses a claims-based access-control authorization model to maintain application security and to implement federated identity.{{cite web|url= https://technet.microsoft.com/en-us/library/adfs2-help-introducing(v=ws.10).aspx|publisher= Microsoft TechNet|title= Introducing ADFS 2.0 | date=May 2, 2010 | accessdate=March 2, 2017}} Claims-based authentication involves authenticating a user based on a set of claims about that user's identity contained in a trusted token. Such a token is often issued and signed by an entity that is able to authenticate the user by other means, and that is trusted by the entity doing the claims-based authentication.{{cite web | url=https://msdn.microsoft.com/en-us/library/ff359101.aspx | title=An Introduction to Claims | publisher=MSDN | date=2016 | accessdate=May 26, 2016}} It is part of the Active Directory Services. Microsoft advises using Entra ID and Entra Connect in place of ADFS in most cases.{{cite web | url=https://www.microsoft.com/en-us/security/business/solutions/modernize-identity-management | title=Modernize Your Identity Management System | Microsoft Security | website=Microsoft }}
Details
In ADFS, identity federation{{cite web | url=https://www.techopedia.com/definition/13617/federated-identity-management-fim | title=What is Federated Identity Management? | publisher=Technopedia | date=2016 | accessdate=May 26, 2016}} is established between two organizations by establishing trust between two security realms. A federation server on one side (the accounts side) authenticates the user through the standard means in Active Directory Domain Services and then issues a token containing a series of claims about the user, including their identity. On the other side, the resources side, another federation server validates the token and issues another token for the local servers to accept the claimed identity. This allows a system to provide controlled access to its resources or services to a user that belongs to another security realm without requiring the user to authenticate directly to the system and without the two systems sharing a database of user identities or passwords.{{cn|date=November 2024}}
In practice a user might typically perceive this approach as follows:
- The user logs into their local PC (as they typically would when commencing work in the morning).
- The user needs to obtain information from a partner company's extranet website, for example to obtain pricing or product details.
- The user navigates to the partner-company extranet site, for example:
http://example.com . - The partner website now does not require any password to be typed in; instead, the user credentials (in a secure assertion) are passed to the partner extranet site using ADFS.
- The user is now logged into the partner website and can interact with the website as if logged in.
ADFS integrates with Active Directory Domain Services, using it as an identity provider. ADFS can interact with other WS-* and SAML 2.0-compliant federation services as federation partners.{{cite web | url=https://blogs.technet.microsoft.com/askpfeplat/2014/11/02/adfs-deep-dive-comparing-ws-fed-saml-and-oauth/ | title=ADFS Deep Dive | publisher=MSDN | date=November 2, 2014 | accessdate=May 18, 2016}}
Versions
- ADFS 1.0 - Windows Server 2003 R2 (additional download)
- ADFS 1.1 - Windows Server 2008 and Windows Server 2008 R2
- ADFS 2.0 - Windows Server 2008 and Windows Server 2008 R2 (download from Microsoft.com)
- ADFS 2.1 - Windows Server 2012
- ADFS 3.0 - Windows Server 2012 R2{{cite web | url=https://www.tatvasoft.co.uk/blog/adfs-configuration-in-windows-server-2012-r2-standard-with-sharepoint-2013/ | title=ADFS Configuration in Windows Server 2012 R2 Standard | publisher=TatvaSoft | date=2018 | accessdate=September 19, 2018 | archive-date=September 19, 2018 | archive-url=https://web.archive.org/web/20180919171849/https://www.tatvasoft.co.uk/blog/adfs-configuration-in-windows-server-2012-r2-standard-with-sharepoint-2013/ | url-status=dead }}
- Windows Server 2016 ADFS - Windows Server 2016{{cite web | url=https://docs.microsoft.com/en-gb/windows-server/identity/ad-fs/overview/ad-fs-faq | title=ADFS Frequently Asked Questions (FAQ) | publisher=Microsoft | date=April 17, 2019| accessdate=March 2, 2020}}
- Windows Server 2019 ADFS - Windows Server 2019
See also
{{div col}}
- Claims-based identity
- Digital identity
- Information Card
- LDAP
- SAML
- Windows CardSpace
- Windows Server 2012
- Windows Server 2008
- WS-Federation
- Office 365
{{div col end}}
References
{{reflist}}
External links
- [http://social.technet.microsoft.com/wiki/contents/articles/ad-fs-2-0-content-map.aspx ADFS 2.0 Content Map]
- [http://go.microsoft.com/fwlink/?LinkID=155025 ADFS TechNet Library]
- [https://msdn.microsoft.com/en-us/library/bb897402.aspx ADFS MSDN Library]
- [https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/overview/whats-new-active-directory-federation-services-windows-server ADFS in Server 2016 What's new]