Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I’m a newbie in the ADFS 2.0 world and I want understand the basic assumptions of that technology.

My goals is guarantee the access to our customer users to web application on our cloud environment.

Here is my scenario:

  • Network “A” – Cloud Environment
    AD Controller (Win 2008)
    IIS 7 Web Server (web application with NTLM provider authentication technology published to the Internet)

  • Network “B” – Customer “X” - Local Network
    AD Controller (Win 2003 or Win 2008)
    PC clients

  • Network “C” – Customer “X” - WAN Network
    PC clients (home PC)

Customer “X” clients in Network B and C should be able to access to web application published on Network “A” with their windows domain credentials.

I’ve read various documentation about that but it’s not clear for me yet. It’s perplexing.

My questions are:

  1. Where do I place the ADFS server?
  2. Do I have to set up anything on the AD Controller in Network “A”?
  3. Does the customer “X” IT team have to set up anything?

I hope that someone can explain the infrastructure schema and the process as well.

share|improve this question
ADFS is probably not what you want in the first place, since you'd have to have a Windows CAL for every customer who uses ADFS. That'd get expensive very quick. – Chris S Jan 25 '13 at 16:23
This thread might also provide a helpful introduction: What is ADFS (Active Directory Federation Services)? – Simon East Aug 14 at 3:45

1 Answer 1

You are describing the federated web SSO scenario as per You could have ADFS in both customer environment and in your own cloud environment and then setup a trust between the two. You need not do anything special in AD itself other than configuring SPNs. But the IT admin from each environment will deploy ADFS in their own environment and configure the trusts as applicable.

Please see the deployment guide for more details Specifically as the hoster of the application you will be the resource partner.

The customer as account partner will follow

I expect you'd find the following book useful too

The content map at should help you find the info you need. There is a lot to read and understand before you deploy identity federation technologies. You might consider getting a consultant to come in and do the work for you if you have time constraints and want it done right.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.