AD FS 2 & Claims-Based Identity
•Descargar como PPTX, PDF•
2 recomendaciones•2,816 vistas
AD FS 2 & Claims-Based Identity provides a consistent identity layer across applications by extracting identity information from Active Directory and other sources and expressing it as standardized claims. This allows applications to authenticate users once via AD FS and receive attributes about the user, without the applications needing direct access to identity stores. Claims can include group memberships, email address, or any other identity attributes that can be used for authorization and personalization. AD FS supports web single sign-on, web services, and "claims-aware" applications via standards like WS-Federation, SAML 2.0, and can federate identity across organizations.
Recomendados
Recomendados
Más contenido relacionado
Destacado
Destacado (20)
Similar a AD FS 2 & Claims-Based Identity
Similar a AD FS 2 & Claims-Based Identity (20)
Más de Nathan Winters
Más de Nathan Winters (20)
Último
Último (20)
AD FS 2 & Claims-Based Identity
- 1. AD FS 2 & Claims-Based Identity Laura E. Hunter Identity Lady, AD FS Zealot laura.hunter@lhaconsulting.com http://www.shutuplaura.com @adfskitteh
- 2. The Problem? We Lack a Consistent Identity Layer for Applications
- 3. The Result?Hard-coded dependencies, “Continuous Wheel Re-Invention”Resistance to Change
- 5. filter = ((&(objectClass=user)(|(sn=*smith*)(displayName=*smith*)(givenName=*smith*)(cn=*smith*))))
- 6. How many different ways can you authenticate to an app?
- 7. Managing Application Identity – First Principles 1. Identify the Caller 2. Extract Information for AuthZ & Personalization
- 8. Windows Integrated Authentication Does Active Directory work everywhere?
- 12. So What’s a Claim? “I am a member of the Marketing group” “My email address is …” “I am over 21 years of age” Populated using information from AD/ADAM/ADLDS SQL Expressed using the SAML format
- 13. <saml:AssertionAssertionID="..." IssueInstant="2006-07-11T03:15:40Z" Issuer=“https://adatum-dc1.adatum.com“> <saml:ConditionsNotBefore="2006-07-11T03:15:40Z" NotOnOrAfter="2006-07-11T04:15:40Z"> <saml:Audience> https://contoso-dc1.contoso.com </saml:Audience> <saml:AuthenticationStatementAuthenticationInstant="2006-07-11T03:15:40Z" AuthenticationMethod="urn:federation:authentication:windows"> <saml:NameIdentifierFormat="http://schemas.xmlsoap.org/claims/UPN">adamcar@adatum.com</saml:NameIdentifier> <saml:AttributeAttributeName="Group” <saml:AttributeValue> Administrators</saml:AttributeValue> <Signaturexmlns="http://www.w3.org/2000/09/xmldsig#"> ab315cdff14d</Signature> </saml:Assertion> Abridged SAML Token(Don’t Squint, Just Get the Big Idea!)
- 14. AD FS is all about the apps!
- 15. Standards-based: WS-Federation WS-Trust SAML 2.0 Use cases: WebSSO Web Services (WCF) What is this…“claims-aware” application of which you speak?
- 16. What Can I do with this?
- 17. Application Access in a Single Org
- 18. Account Partner (ADATUM) Resource Partner (CONTOSO) A. Datum Account Forest Trey Research Resource Forest Federation Trust Federated Application Access
- 19. SSO to Service Providers
- 20. Cloudy with a Chance of Federation
- 21. So what does it look like?
- 22. WS-Fed Passive Profile Account Partner (Users) Resource Partner (Resource) A. Datum Account Forest Trey Research Resource Forest Federation Trust
- 23. Something lost, something gained… What about passwords? What about deprovisioning?
- 24. Liberty Alliance Results… ADFS 2 SAML 2.0 Interop Testing with Entrust, IBM, Novell, Ping, SAP, Siemens IdP Lite SP Lite EGov 1.5 Matrix testing results:http://www.projectliberty.org/liberty/liberty_interoperable/implementations/saml_2_0_test_procedure_v3_2_2_full_matrix_implementation_table_q309/
- 26. If you remember nothing else but this…
- 27. I want the integrity of yourusers’ identity information when they access myresources…
- 28. …to be at least as good…
- 29. as the integrity of yourusers’ identity information when they access yourresources.
- 30. AD FS components are Windows components No additional server software costs …but it’s all about the apps! AD FSv2 (was “Geneva”) Release Candidate Available Now RTM…“Soon” Windows Identity Foundation .NET Developer Platform Free Download Available now! AD FS 2.0 Availability, Pricing
- 31. AD Cookbook, 3rd Edition Best selling Active Directory title What’s New? Windows Server 2008 coverage: Read Only Domain Controllers (RODCs) Fine Grained Password Policies (FGPPs) Exchange 2007 integration & scripting Identity Lifecycle Manager 2007 Windows PowerShell & Active Directory .NET programming New user interface features Always more than one way! Learn More! http://oreilly.com/catalog/9780596521103/
- 32. Thank You! mailto: laura.hunter@lhaconsulting.com blog: http://www.shutuplaura.com twitter: @adfskitteh
Notas del editor
- Hard-coded dependencies
- Re-inventing the wheel – asking our devs to be AD experts
- Resistance to change – smart card, cloud, etc.
- Identify the caller (AuthN)Grep information about the caller for AuthZ & personalization
- Partner fed
- Fed with the cloud
- Hide.Fedutil, pre-baked RP trust
- For WinHIED
- For WinHIED