70

So I've been told that our PHP application may need to support authentication using ADFS.

  1. For a non-Microsoft person, what is ADFS?

  2. How does it differ to things like LDAP?

  3. How does it work? What kind of information would be included in a typical request to an ADFS server? Is it designed for both authentication and authorization?

  4. Are ADFS servers typically accessible from the internet (whereas corporate AD domain controllers would not be)?

I've tried reading some of the Technet docs, but it's full of Microsoft-speak that isn't hugely helpful.

Wikipedia is better (see below), but perhaps some of the ServerFault community can fill in some of the gaps.

Active Directory Federation Services (ADFS) is a software component developed by Microsoft that can be installed on Windows Server operating systems to provide users with single sign-on access to systems and applications located across organizational boundaries. It uses a claims-based access control authorization model to maintain application security and implement federated identity.

Claims-based authentication is the process of authenticating a user based on a set of claims about its identity contained in a trusted token.

In ADFS, identity federation is established between two organizations by establishing trust between two security realms. A federation server on one side (the Accounts side) authenticates the user through the standard means in Active Directory Domain Services and then issues a token containing a series of claims about the user, including its identity. On the other side, the Resources side, another federation server validates the token and issues another token for the local servers to accept the claimed identity. This allows a system to provide controlled access to its resources or services to a user that belongs to another security realm without requiring the user to authenticate directly to the system and without the two systems sharing a database of user identities or passwords.

In practice this approach is typically perceived by the user as follows:

  1. The user logs into their local PC (as they typically would when commencing work in the morning)
  2. The user needs to obtain information on a partner company's extranet website - for example to obtain pricing or product details
  3. The user navigates to the partner company extranet site - for example: http://example.com
  4. The partner website now does not require any password to be typed in - instead, the user credentials are passed to the partner extranet site using AD FS
  5. The user is now logged into the partner website and can interact with the website 'logged in'

From https://en.wikipedia.org/wiki/Active_Directory_Federation_Services

  • I found these articles and this video helpful in providing an overview. – Simon East Jul 27 '15 at 3:36
  • Reaces provided an excellent answer. The only additional information I would add is that it might pay to understand WS-Federation protocol and Security Assertion Markup Language (SAML) which are the standards that ADFS implements. Here are a few videos I found useful in understanding these (quite complex) concepts. Unfortunately they contain so much material that I can't include it here. ![Video thumbnail Understanding SAML and Single Sign-On 101 on YouTube](youtube.com/watch?v=gUmMcecHN9s) [![Video thumbnail](http – Simon East Aug 14 '15 at 3:24
  • I also had a trouble understanding ADFS. I needed an explanation from the very beginning (I am not an AD person). This video that is included in the series that are mentioned in the comments here, was very helpful for me. This is where any new, zero-experience person with ADFS should start and then continue with the rest of the videos in the series. I hope it helps. youtube.com/… – Mauricio Zaragoza Sep 2 '17 at 18:39
  • 1
    Sorry folks, a moderator deleted my answer with the helpful videos and made it a comment above but that's now broken. Frustrating. – Simon East Sep 6 '17 at 1:48
90

For a non-Microsoft person, what is ADFS?

ADFS is Microsoft's solution for Single Sign On and web based authentication.

It is used primarily to provide a single set of credentials that can access a variety of sites not necessarily hosted within the same domain.

How does it differ to things like LDAP?

LDAP:

  • Communicates using TCP/UDP on port 389 (or port 636 for LDAPS)
  • Contains commands for searching/retrieving/adding/deleting/modifying users, profiles and other directory entries
  • Can not be performed directly by a web browser, however HTTP authentication can be translated to LDAP using things like Apache's mod_authnz_ldap.
  • When used for third-party website authentication, requires that username & password are provided to the third-party, which is not ideal for security.
  • Is more of an open standard and has numerous Linux implementations.

ADFS:

  • Better designed for the web as it communicates over standard HTTPS
  • Follows a safer process similar (but not exact) to OAuth where the original username/password are provided directly to the organisation's ADFS server (or a proxy, but not the third-party), which if valid, returns a unique token that can be used to access a third-party website.
  • Although it does use make use of some open standards (HTTPS, SAML etc.) it is Microsoft-specific and requires Internet Information Services (IIS) which only runs on Windows Servers.

See also this answer on the subject.

How does it work? What kind of information would be included in a typical request to an ADFS server? Is it designed for both authentication and authorization?

It works by having a single site (site A) that hosts the ADFS / ADFS proxy servers, which has access to the credentials (usually by communicating with an Active Directory Domain Controller). It is then given a trust between other sites (sites B & C) that require authenticating through the ADFS.

When a user attempts to access site B in their browser, the site redirects the user to the ADFS-proxy website (site A) which asks for their username & password, authenticates them, returns a set of cookies for remembering them, and redirects them back to the site B, along with an access token.

If the user then attempts to visit site C, they will also get redirected to site A for authentication from the ADFS-proxy website. If the right cookies exist, the user will not be required to enter their password again, but get instantly redirected back to site C with a token.

The ADFS can be configured with specific claims (or permissions) for the user, for authorization purposes. So it can serve both roles. (Note the difference between authentication and authorization.)

Some people prefer not to use it for authorization but instead keep the permissions management in the third-party website. The obvious downside is that both site A & B need to keep track of user accounts, while in the scenario where ADFS handles both, only the ADFS needs to be aware of the users.

Are ADFS servers typically accessible from the internet (whereas corporate AD domain controllers would not be)?

Yes, nearly always. ADFS is based on the notion that it will be primarily used for website authentication. And is built around IIS.

The ADFS-proxy site is the one that is usually accessible from the internet. However the ADFS itself is not. The ADFS is generally a separate server from the ADFS-proxy.

  • ADFS Server
    Server that links to the credentials, and has the claims configuration as well as the trusts. Generally not publicly accessible.
  • ADFS Proxy Server
    Server that hosts the IIS instance that has the login pages for the websites requiring authentication. Communicates back to the ADFS when requiring authentication. Generally publicly accessible.
  • 8
    To clarify: ADFS Proxy Server must run on IIS (Windows). However, client websites (B & C) can run any OS and web server, including Linux. – Olli Sep 23 '16 at 7:57
  • Very helpful, just created an account for thumbing up this. – Juan May 22 '18 at 6:47

protected by Community Sep 2 '17 at 21:02

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.