What is AD FS (Active Directory Federation Services) ?

 

AD FS (Active Directory Federation Services) is a Microsoft identity and access management solution that provides Single Sign-On (SSO) and federated identity capabilities. AD FS enables users to access multiple applications or services across organizational boundaries without the need to log in separately to each one. It facilitates secure authentication and authorization for users from different domains or organizations.

Here's a use case with a live example of AD FS:

Use Case: Federated Single Sign-On for Partner Organizations

Scenario: Company A has an internal web application used by its employees for accessing sensitive corporate data. Company B, a partner organization, needs access to this application for collaboration. Both companies want their users to access the application seamlessly without the need for separate credentials.

Solution Using AD FS:

1. Deployment of AD FS Servers:

   • Company A deploys AD FS servers within its network. These servers act as the identity provider (IdP) and handle authentication requests for Company A's users.

2. Federation Trust Setup:

   • Company A establishes a federation trust with Company B. This trust is a mutual agreement that allows Company B's users to authenticate with their own identity provider (e.g., their own AD FS) and access Company A's application.

3. Claims-Based Authentication:

   • Both Company A and Company B configure their AD FS servers to use claims-based authentication. Instead of sending actual user credentials, AD FS sends claims (attributes) about the user to the application.

4. SAML-Based Authentication:

   • Security Assertion Markup Language (SAML) is often used for exchanging authentication and authorization data between identity providers (e.g., Company B's AD FS) and service providers (e.g., Company A's application).

5. User Access Flow:

   • A user from Company B wants to access Company A's application.
   • The user accesses the application and is redirected to Company B's AD FS for authentication.
   • Company B's AD FS performs the user authentication and sends a SAML token containing claims about the user's identity back to the application.
   • The application trusts the SAML token because of the federation trust, and it grants access to the user based on the claims in the token.

Live Example:

• Suppose Company A uses AD FS to secure its internal application, and Company B uses its own AD FS as an identity provider for its users.
• A user from Company B needs access to Company A's application. The user goes to the application's login page.
• Instead of providing separate login credentials for Company A's application, the user is redirected to Company B's AD FS for authentication.
• Company B's AD FS authenticates the user based on its own user database.
• After successful authentication, Company B's AD FS generates a SAML token containing claims about the user's identity.
• This SAML token is sent back to Company A's application.
• Company A's application trusts the SAML token because of the federation trust established between the two organizations.
• The user is granted access to Company A's application without needing to enter separate credentials.

AD FS simplifies the user experience and enhances security in scenarios where organizations need to collaborate and share resources securely across boundaries. It's commonly used in business-to-business (B2B) scenarios, cloud identity federation, and scenarios involving partner organizations.