Ce site est optimisé pour être consulté depuis un navigateur moderne dans lequel JavaScript est activé.

Qu'est-ce qu'ADFS (Active Directory Federation Services) ?

ayi

So J'ai been told that our PHP application may need to support authentication using ADFS.

For a non-Microsoft person, what is ADFS?

How does it differ to things like LDAP?

How does it work? What kind of information would be included in a typical request to an ADFS server? Is it designed for les deux authentication et authorization?

Are ADFS servers typically accessible depuis le internet (whereas corporate AD domain controllers would pas be)?

J'ai tried reading certains of le Technet docs, mais c'est full of Microsoft-speak that n'est pas hugely helpful.

Wikipedia is better (see below), mais perhaps certains of le ServerFault community can fill in certains of le gaps.

Active Directory Federation Services (ADFS) is a software component developed by Microsoft that can be installed on Windows Server operating systems to provide users avec single sign-on access to systems et applications located across organizational boundaries. It uses a claims-based access control authorization model to maintain application security et implement federated identity.

Claims-based authentication is le process of authenticating a user based on a set of claims about its identity contained in a trusted token.

In ADFS, identity federation is established entre two organizations by establishing trust entre two security realms. A federation server on one side (the Accounts side) authenticates le user through le standard means in Active Directory Domain Services et alors issues a token containing a series of claims about le user, including its identity. On le autre side, le Resources side, another federation server validates le token et issues another token for le local servers to accept le claimed identity. This allows a system to provide controlled access to its resources ou services to a user that belongs to another security realm sans requiring le user to authenticate directly to le system et sans le two systems sharing a database of user identities ou passwords.

In practice this approach is typically perceived by le user as follows:

The user logs into leur local PC (as they typically would quand commencing work in le morning)
The user needs to obtain information on a partner company's extranet website - par exemple to obtain pricing ou product details
The user navigates to le partner company extranet site - par exemple: http://example.com
The partner website now does pas require tout password to be typed in - instead, le user credentials are passed to le partner extranet site using AD FS
The user is now logged into le partner website et can interact avec le website 'logged in'

From https://en.wikipedia.org/wiki/Active_Directory_Federation_Services

ayi

For a non-Microsoft person, what is ADFS?

ADFS is Microsoft's solution for Single Sign On et web based authentication.

C'est used primarily to provide a single set of credentials that can access a variety of sites pas necessarily hosted within le même domain.

How does it differ to things like LDAP?

LDAP:

Communicates using TCP/UDP on port 389 (or port 636 for LDAPS)
Contains commands for searching/retrieving/adding/deleting/modifying users, profiles et autre directory entries
Can not be performed directly by a web browser, however HTTP authentication can be translated to LDAP using things like Apache's mod_authnz_ldap.
When used for third-party website authentication, requires that username & password are provided to le third-party, qui is pas ideal for security.
Is more of an open standard et has numerous Linux implementations.

ADFS:

Better designed for le web as it communicates over standard HTTPS
Follows a safer process similaire (but pas exact) to OAuth où le original username/password are provided directly to le organisation's ADFS server (or a proxy, mais not le third-party), qui si valid, returns a unique token that can be used to access a third-party website.
Although it does use make use of certains open standards (HTTPS, SAML etc.) it is Microsoft-specific et requires Internet Information Services (IIS) qui seulement runs on Windows Servers.

See aussi this answer on le subject.

How does it work? What kind of information would be included in a typical request to an ADFS server? Is it designed for les deux authentication et authorization?

It works by having a single site (site A) that hosts le ADFS / ADFS proxy servers, qui has access to le credentials (usually by communicating avec an Active Directory Domain Controller). C'est alors given a trust entre autre sites (sites B & C) that require authenticating through le ADFS.

When a user attempts to access site B in leur browser, le site redirects le user to le ADFS-proxy website (site A) qui asks for leur username & password, authenticates them, returns a set of cookies for remembering them, et redirects them back to le site B, along avec an access token.

If le user alors attempts to visit site C, they will aussi get redirected to site A for authentication depuis le ADFS-proxy website. If le right cookies exist, le user will pas be requis to enter leur password again, mais get instantly redirected back to site C avec a token.

The ADFS can be configured avec spécifique claims (or permissions) for le user, for authorization purposes. So it can serve les deux roles. (Note le difference between authentication and authorization.)

Some people prefer pas to use it for authorization mais à la place keep le permissions management in le third-party website. The obvious downside is that les deux site A & B need to keep track of user accounts, tandis que in le scenario où ADFS handles both, seulement le ADFS needs to be aware of le users.

Are ADFS servers typically accessible depuis le internet (whereas corporate AD domain controllers would pas be)?

Yes, nearly always. ADFS is based on le notion that it will be primarily used for website authentication. And is built around IIS.

The ADFS-proxy site is le one that is usually accessible depuis le internet. However le ADFS itself is not. The ADFS is generally a separate server depuis le ADFS-proxy.

ADFS Server

Server that links to le credentials, et has le claims configuration as well as le trusts. Generally pas publicly accessible.

ADFS Proxy Server

Server that hosts le IIS instance that has le login pages for le websites requiring authentication. Communicates back to le ADFS quand requiring authentication. Generally publicly accessible.