Currently i'm working with ADFS to establish a federated trust between two separated domains.
My question is simple: does ADFS v. 2.0 support transitive trust across federated identity providers? And if so, see the questions below. (I'm not talking about AD forest trusts but about compleatly separated domains using pure ADFS 2.0 in a federation scenario)
I know that ADFS v 1.0 does not, as stated in this document on page 9. But when looking on the claims rules that come with ADFS 2.0 it seems to be possible, as a Microsoft partner confirmed. However: the documentation on this topic is a mess! Simply no ADFS v. 2.0 related statements on this topic that i was able to find (IF you got any documentation on this PLEASE help me out guys!).
To be more clear, lets assume this scenario:
Federation provider (A) trust federation provider (B) which trusts identity provider (C). So, does (A) trust identities comming from (C) across (B)?
Fruther questions in case of support of transitive trust:
- Is it possible to restrict the transitive trust in ADFS in any way? If so, how? (Powershell Command or ADFS GUI menü entry where to find it)
- How does the transitive trust affect the Issuer and OriginalIssuer properties of the claims?
- If transitive trust is used together with claims transformations and provider (B) would transform incomming claims from (C) in a way that they are transformed into (new) claims of same type an value, how would this affect the Issuer and OriginalIssuer properties?
IMPORTANT: whether it's supported or not, I need some official sources on this. However, if nobody else will be able to provide them and someone is able to answer the questions with his experience, i'm willed to give the bounty to him / her even without official sources.