I want to implement SAML for Remote Desktop Services on Windows Server 2012R2.

First, is it possible ?

Then, I want to authenticate users from another AD with my RDS, like this architecture : https://technet.microsoft.com/en-us/library/dd807050(v=ws.11).aspx

At this point, I'm able to authenticate users with SSO on the same AD, but not with an other.


Yes I think it should work while I haven't test this so far. Create & configure ADFS server on the domain B, then create claim provide trust on domain A to make the domain A can accept the users' security token issued by domain B. Also consider the followings:

  1. Network consideration: No matter the users of domain B access the claim-aware application from the Intranet or Internet. The Federation Service Name of domain A and domain B should be able to resolve correctly. If you are using WAP then the external federation service name should be resolved to the IP of WAP server. The Port 443 should not be blocked by the firewall.

  2. Certificate consideration: The SSL certificates used in these two domains should be trusted on each domain and the external accessed clients.

More details about the ADFS requirements to get it works you can refer to docs here:

| improve this answer | |
  • Thanks for your answer. ADFS on domain B is the Identification Provider and ADFS on domain A is the Service Provider ? – Thibaut Feb 15 '17 at 10:52
  • Yes, that's correct. Users should be able to choose the identity partner on the ADFS redirect page based on which domain the user comes from. – Jimmy Sun Feb 16 '17 at 1:34
  • To add on, the domain A which the claim-aware application located in should be IDP & SP because it also provides identity for its own users. – Jimmy Sun Feb 16 '17 at 1:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.