Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I’m a newbie in the ADFS 2.0 world and I want understand the basic assumptions of that technology. My goals is guarantee the access to our customer users to web application on our cloud environment.

Following I’m going to explain an example of our scenario:

  • Network “A” – Cloud Environment

AD Controller (Win 2008)

IIS 7 Web Server (web application with NTLM provider authentication technology published to the Internet)


  • Network “B” – Customer “X” - Local Network

AD Controller (Win 2003 or Win 2008)

PC clients


  • Network “C” – Customer “X” - WAN Network

PC clients (home pc)

Customer “X” clients in Network B and C should be able to access to web application published on Network “A” with their windows domain credentials.

I’ve read various documentation about that but it’s not clear for me yet. I’m perplexing.

My questions are: Where do I place the ADFS server? Do I have to set up nothing in AD Controller in Network “A”? Does the customer “X” IT team have to set up anything? I hope that someone to help me to develop the infrastructure schema and the process as well.

share|improve this question
ADFS is probably not what you want in the first place, since you'd have to have a Windows CAL for every customer who uses ADFS. That'd get expensive very quick. –  Chris S Jan 25 '13 at 16:23

1 Answer 1

You are describing the federated web SSO scenario as per http://technet.microsoft.com/en-us/library/cc757344(v=WS.10).aspx. You could have ADFS in both customer environment and in your own cloud environment and then setup a trust between the two. You need not do anything special in AD itself other than configuring SPNs. But the IT admin from each environment will deploy ADFS in their own environment and configure the trusts as applicable.

Please see the deployment guide for more details http://technet.microsoft.com/en-us/library/dd807092(v=ws.10).aspx. Specifically as the hoster of the application you will be the resource partner. http://technet.microsoft.com/en-us/library/dd807047(v=ws.10).aspx

The customer as account partner will follow http://technet.microsoft.com/en-us/library/dd807112(v=ws.10).aspx

I expect you'd find the following book useful too http://msdn.microsoft.com/en-us/library/ff423674.aspx

The content map at http://social.technet.microsoft.com/wiki/contents/articles/2735.ad-fs-2-0-content-map.aspx should help you find the info you need. There is a lot to read and understand before you deploy identity federation technologies. You might consider getting a consultant to come in and do the work for you if you have time constraints and want it done right.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.