We have a couple of internal asp.net web applications. Intranet users authenticate using AD, and are authorized in the internal apps using the web.config ( sections), by their AD groups or specific account names. Nothing fancy here. But recently, our organization has decided to move some of these internal apps to a cloud offered by a 3rd party.
The apps are reachable though our internal network using a VPN with the cloud. However, the apps are now in a different AD domain. We do not want to replicate our current directory in that new AD, and users do not want to log into another domain.
I was thinking on using ADFS for this. I found a similar scenario described in http://technet.microsoft.com/en-us/library/cc771308(v=ws.10).aspx. But, I feel mine it's much simpler.
Thus, the questions:
- Is ADFS the right solution for this?
- Do I need a Resource Federation Server installed in the Cloud-based portion of my network?
- Can I keep authorizing users/groups using the web.config ( sections) in those web apps?
I would be grateful for any tip, pointers or recommendation on using ADFS in a similar scenario.