Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are working with a big client who wants to have two completely separate environments for a CRM 2011 installation. And that would go down to having two separate ADFS servers in the domain. Are there any negative affects to having two ADFS servers inside a domain? They would obviously live on different URLs but would rely on the same AD forest for their auth backing.

share|improve this question
up vote 2 down vote accepted

I can't say for certain (someone could certainly prove me wrong), but I think the only thing you'd be losing out on is the Single Sign On cookie. I imagine that's a per-farm type of thing. That cookie signals you've already been authenticated via an ADFS server and doesn't bother authenticating you again if the ADFS server is configured to do this.

This is the situation I'm speaking of:

  1. User goes for web app 1 and redirected to ADFS Server #1
  2. User authenticated by ADFS server #1
  3. User goes for web app 2 and redirected to ADFS Server #1
  4. If you have the cookie, ADFS server doesn't retry the authentication if the SingSignOn is configured on the ADFS server. It knows it's already recently authenticated you.

Now if you replace Server #2 in Step 3, I imagine that the cookie is going to be stored in each ADFS's SQL database - and it's not just an encoded form of a kerberos ticket.

Since Server #1 and #2 don't share a SQL database (they aren't in a farm), you wouldn't get the SingleSignOn thing. So some efficiently lost - probably not a big deal unless you are in a massive environment. It will just run another authentication against AD.

Other than that, they will work just fine and authenticate users all day long. We actually have two ADFS farms here - one forcing FORMS login, and the other just allowing Windows Integrated. We have SingleSignOn disabled or I might have a definitive answer for you.

share|improve this answer
Thanks so much Matt! – chris.w.mclean Jun 16 '11 at 4:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.