Active Directory Federation Services (ADFS), a

software Software consists of computer programs that instruct the Execution (computing), execution of a computer. Software also includes design documents and specifications. The history of software is closely tied to the development of digital comput ...

component developed by

Microsoft Microsoft Corporation is an American multinational corporation and technology company, technology conglomerate headquartered in Redmond, Washington. Founded in 1975, the company became influential in the History of personal computers#The ear ...

, can run on

Windows Server Windows Server (formerly Windows NT Server) is a brand name for Server (computing), server-oriented releases of the Windows NT operating system (OS) that have been developed by Microsoft since 1993. The first release under this brand name i ...

operating systems to provide users with single sign-on access to systems and applications located across organizational boundaries. It uses a claims-based access-control authorization model to maintain application security and to implement

federated identity A federated identity in information technology is the means of linking a person's electronic identity and attributes, stored across multiple distinct identity management systems. Federated identity is related to single sign-on (SSO), in which a ...

. Claims-based authentication involves authenticating a user based on a set of claims about that user's

identity Identity may refer to: * Identity document * Identity (philosophy) * Identity (social science) * Identity (mathematics) Arts and entertainment Film and television * ''Identity'' (1987 film), an Iranian film * ''Identity'' (2003 film), an ...

contained in a trusted token. Such a token is often issued and signed by an entity that is able to authenticate the user by other means, and that is trusted by the entity doing the claims-based authentication. It is part of the Active Directory Services. Microsoft advises using

Entra ID Microsoft Entra ID (formerly known as Microsoft Azure Active Directory or Azure AD) is a cloud-based identity and access management (IAM) solution. It is a directory and identity management service that operates in the cloud and offers authent ...

and

Entra Connect Entra ASA is a Norwegian real estate company, headquartered in Oslo, Norway. Operations The company was founded in 2000 when all commercial real estate owned by the state through Statsbygg was transferred to Entra.Even Landre and Johann D. Su ...

in place of ADFS in most cases.

Details

In ADFS, identity federation is established between two organizations by establishing trust between two security realms. A federation server on one side (the accounts side) authenticates the user through the standard means in

Active Directory Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. Windows Server operating systems include it as a set of processes and services. Originally, only centralized domain management used Active Direct ...

Domain Services and then issues a token containing a series of claims about the user, including their identity. On the other side, the resources side, another federation server validates the token and issues another token for the local servers to accept the claimed identity. This allows a system to provide controlled access to its resources or services to a user that belongs to another security realm without requiring the user to authenticate directly to the system and without the two systems sharing a database of user identities or passwords. In practice a user might typically perceive this approach as follows: # The user logs into their local PC (as they typically would when commencing work in the morning). # The user needs to obtain information from a partner company's extranet website, for example to obtain pricing or product details. # The user navigates to the partner-company extranet site, for example: http://example.com. # The partner website now does not require any password to be typed in; instead, the user credentials (in a secure assertion) are passed to the partner extranet site using ADFS. # The user is now logged into the partner website and can interact with the website as if logged in. ADFS integrates with

Domain Services, using it as an identity provider. ADFS can interact with other WS-* and

SAML 2.0 Security Assertion Markup Language (SAML) 2.0 is a version of the Security Assertion Markup Language, SAML standard for exchanging authentication and authorization identities between security domains. SAML 2.0 is an XML-based communications ...

-compliant federation services as federation partners.

Versions

* ADFS 1.0 - Windows Server 2003 R2 (additional download) * ADFS 1.1 - Windows Server 2008 and Windows Server 2008 R2 * ADFS 2.0 - Windows Server 2008 and Windows Server 2008 R2 (download from Microsoft.com) * ADFS 2.1 - Windows Server 2012 * ADFS 3.0 - Windows Server 2012 R2 * Windows Server 2016 ADFS - Windows Server 2016 * Windows Server 2019 ADFS - Windows Server 2019

References

{{reflist

External links

ADFS 2.0 Content Map

ADFS TechNet Library

ADFS MSDN Library

ADFS in Server 2016 What's new
2008 software Windows Server Windows Server 2008 Windows Server 2008 R2

Details

Versions

See also

References

External links