Microsoft Sharepoint 2013 : Federated Authentication (part 1) - Active Directory Federated Services - Install Certificate Authority

In the section titled “Configuring a Claims Web Application” I briefly touched on federated authentication within SharePoint via Trusted Identity Providers. In this section, we shall explore the use of federated authentication, using Active Directory Federated Services.

Active Directory Federated Services

Active Directory Federated Services is a service provided by Microsoft to provide federated claims authentication. ADFS uses the WS-Federation standard protocol and returns secure tokens in Security Assertion Markup Language format.

Administrators may download ADFS from the following link, install it, and configure it via a Microsoft Management Console (MMC): www.microsoft.com/en-us/download/details.aspx?id=10909 .

Why would you be interested in federated authentication and why ADFS? Although SharePoint is not strictly federating authentication, since the platform is still authenticating users, it has abstracted authentication via its own Secure Token Service. ADFS brings true federated authentication because ADFS is a separate service that any application can leverage, as long as it supports WS-Federation and SAML. The following is a list of some of the benefits that ADFS brings to your organization:

• Single-Sign-On (SSO): If ADFS is the central hub for authentication of any application in the organization then these applications can offer SSO. A user authenticates through one application and ADFS generates a SAML token for the user. When the same user attempts to authenticate via a different application—also using ADFS—ADFS sends back the same token without prompting the user for credentials because ADFS remembers the user (via cookie or NTLM token) from the first authentication success.
• WS-* Interoperability: ADFS interoperates with any system that supports WS-Federation and supports the WS-* standards of other security-based services. Without ADFS, applications on the Microsoft Windows Server platform must implement claims authentication using the Windows Identity Framework to support authentication federation. ADFS enables authentication federation for applications that do not provide their own authentication federation via WS-Federation protocols.
• Avoids Credential Management: Using ADFS, you can allow users to authenticate with other claims-aware applications (such as Windows Azure) and provide access for users of these applications to your applications without having to manage account credentials. Users maintain their own credentials via these independent account providers, ADFS facilitates the authentication process, and your applications only have to keep a record of unique user identity (based on claims in SAML tokens) to identify an authenticated user.
• Claims Mapping: ADFS understands claims provided by federated providers and can map them into different claim types in use in your organization.
• Extensible Architecture: ADFS supports custom claims augmentation (associating claims with a user’s identity), via custom extensions implemented by developers and third parties.