1

We are working with a big client who wants to have two completely separate environments for a CRM 2011 installation. And that would go down to having two separate ADFS servers in the domain. Are there any negative affects to having two ADFS servers inside a domain? They would obviously live on different URLs but would rely on the same AD forest for their auth backing.

Improve this question

1 Answer 1

Reset to default
3

I can't say for certain (someone could certainly prove me wrong), but I think the only thing you'd be losing out on is the Single Sign On cookie. I imagine that's a per-farm type of thing. That cookie signals you've already been authenticated via an ADFS server and doesn't bother authenticating you again if the ADFS server is configured to do this.

This is the situation I'm speaking of:

  1. User goes for web app 1 and redirected to ADFS Server #1
  2. User authenticated by ADFS server #1
  3. User goes for web app 2 and redirected to ADFS Server #1
  4. If you have the cookie, ADFS server doesn't retry the authentication if the SingSignOn is configured on the ADFS server. It knows it's already recently authenticated you.

Now if you replace Server #2 in Step 3, I imagine that the cookie is going to be stored in each ADFS's SQL database - and it's not just an encoded form of a kerberos ticket.

Since Server #1 and #2 don't share a SQL database (they aren't in a farm), you wouldn't get the SingleSignOn thing. So some efficiently lost - probably not a big deal unless you are in a massive environment. It will just run another authentication against AD.

Other than that, they will work just fine and authenticate users all day long. We actually have two ADFS farms here - one forcing FORMS login, and the other just allowing Windows Integrated. We have SingleSignOn disabled or I might have a definitive answer for you.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .