1. ADFS & SharePoint the real world
Thomas Vochten
November 19, 2014 | SharePoint Connect Amsterdam

3. About Me
Thomas VochtenSharePoint MVP. Platform architect. Speaker. Trainer. Involuntary DBA. Consultant at Xylos. V-TSP at Microsoft.
@thomasvochtenhttp://thomasvochten.com
mail@thomasvochten.com

4. Agenda

5. Claims based identity

6. Claims based identity

7. Claims based identity
Authorization decisions are based on claims

8. Some claims examples

9. Use Cases
Federation
Single Sign On

10. Solutions on the market

11. Why ADFS ?
ADFS Wiki on TechNet: http://thvo.me/adfswiki

12. Vocabulary

13. Claims Token
Claim
Claim
Claim
Claim
Signature
Name
Age
Location

14. Claims in SharePoint 2013

15. Windows Claims

16. Trusted Provider Claims

17. Identity Normalization

18. Simplified Logon Process with ADFS

21. Prerequisites

22. Installing ADFS
Windows Server 2008 R2
ADFS2.0 (free download)
Windows Server 2012
ADFS 2.1 (included)
Windows Server 2012R2
ADFS 3.0 (included)
Configuration is stored in
•Windows Internal Database (standalone)
•SQL Server (farm)
Install-WindowsFeature ADFS-Federation -IncludeManagementTools

30. #
# Windows PowerShell script for AD FS Deployment
#
Import-Module ADFS
# Get the credential used for the federation service account
$serviceAccountCredential= Get-Credential
Install-AdfsFarm`
-CertificateThumbprint:"E76240FE42A81F9D61832A47DFD752EE6DB3A5A5" `
-FederationServiceDisplayName:"THVO Federation" `
-FederationServiceName:"fed.thvo.net" `
-ServiceAccountCredential:$serviceAccountCredential`
-SQLConnectionString:"Data Source=alias_FSDB;InitialCatalog=ADFSConfiguration;IntegratedSecurity=True;MinPool Size=20"

32. Configuring ADFS

33. Prepare SharePoint for ADFS

34. Create the Trusted Security Token Issuer
# Import the ADFS token signing certificate to SharePoint
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:FS01-TokenSigning.cer")
New-SPTrustedRootAuthority -Name "FS01 Token SigningCertificate" -Certificate $cert
# Define the claims type mappings
$emailClaimMap = New-SPClaimTypeMapping -IncomingClaimType"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName"EmailAddress" -SameAsIncoming
$roleClaimMap = New-SPClaimTypeMapping -IncomingClaimType"http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName"Role" -SameAsIncoming
$upnClaimMap = New-SPClaimTypeMapping -IncomingClaimType"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" -IncomingClaimTypeDisplayName"UPN" -SameAsIncoming

35. Create the Trusted Security Token Issuer
# Create the trusted identity provider
$realm = "urn:sharepoint:intranet"
$signInURL = "https://sts.lab.thvo.net/adfs/ls"
$issuer = New-SPTrustedIdentityTokenIssuer -Name "ADFS" -Description"ADFS Trusted Identity Provider" `
-Realm $realm -ImportTrustCertificate $cert `
-ClaimsMappings $emailClaimMap,$roleClaimMap,$upnClaimMap `
-SignInUrl $signInURL `
-IdentifierClaim $upnClaimMap.InputClaimType

36. Modify your web application

37. Multiple Web Apps / Host Named Sites
37
$issuer= Get-SPTrustedIdentityTokenIssuer"FED01"
$uri = new-object System.Uri("https://sf01-my.thvo.net/_trust/")
$issuer.ProviderRealms.Add($uri, "urn:sharepoint:sf01-my")
$issuer.Update()
$issuer= Get-SPTrustedIdentityTokenIssuer"FED01"
$isser.UseWReplyParameter= $true
$issuer.Update()

38. People Picker

39. Claims Encoding
i:0#.t|fed01|thomasv
i:0#.w|labthomasv
© Wictor Wilén

40. Custom Claims Provider
https://ldapcp.codeplex.com/

41. User Profile Service

42. (User) Pictures in multiple sites or web applications
$wa = Get-SPWebApplication https://sf01-content.thvo.net
$wa.CrossDomainPhotosEnabled = $true
$wa.Update()

43. Search

44. SharePoint Hosted Apps
44

45. Cookies

47. Thank you!
@thomasvochten