I am trying to setup an ADFS proxy in a DMZ as per Microsoft's best practices, but do not really understand how this is done practically. The basic premise is that a server is placed in the DMZ and all HTTPS traffic from the internet is forwarded to this server. This server then communicates with the ADFS server on the internal network. Now, does it mean that the ADFS proxy server has two network cards, each in the respective network? Or do i need to setup routing between the two zones? If that is the case, i would have to setup default route on the ADFS Proxy in the DMZ. Any insights or tips are greatly appreciated.
You would need to configure routing to allow the two servers to talk on port 443. On my network, the DMZ is routable. You could do a separate network card on the internal ADFS server if this is not an option. The DMZ server will need to be able to resolve the ADFS server by name (entry in the host file) to be able to enable the trust between the two(Web Application Proxy role). As well as having the SSL certificate of the Federation Service Name installed.