What is ADFS 2.0?
Active Directory Federation Services (ADFS) is a Microsoft identity access solution. It was an optional component of Microsoft Windows Server® 2003 R2, now built into Windows Server® 2008. ADFS helps you establish trust relationships and reduces the need for provisioning and managing user accounts. Its implementation provides browser-based clients (internal or external to your network) with seamless, “Single Sign-On” access to one or more protected Internet-facing applications (e.g. Cloud based services such as Office 365).
Trust relationships is used to project a user’s digital identity and access rights to trusted partners and can be deployed in multiple organisations in order to facilitate business-to-business (B2B) transactions between trusted partner organisations.
ADFS 2.0 Basic Components:
Servers – Proxy – Configuration Store (Database)
ADFS Server: Responsible for user authentication and issuance of claims. The Server must be able to connect to a Domain Controller. It authenticates users from multiple domains via windows trust. The ADFS server can be setup in cluster for high availability.
ADFS Proxy Server: Authenticates users from the internet and protects the ADFS Server from Internet based threats. Multiple ADFS proxy servers can be setup in cluster for high availability solutions.
ADFS configuration Database Relying party trust, certificates, claim Provider trust, claims description, service configuration, attributes… are all stored in the Database. The entire content of the Database can be stored as in instance of SQL database or Windows Internal Database (max 5 servers) but not both at the same time.
ADFS 2.0 Load Balancing (Proxy and Servers)
3 basic Load Balancing Methods:
- DNS round robin.
- Windows Network Load Balancing (WNLB).
- Hardware based network load balancing (KEMP).
Load Balancing ADFS Servers 2.0
Traffic & Process flow of the KEMP Load Balanced ADFS 2.0 farm.
1. The user on the internal corporate site uses the Web browser to access the ADFS external resource.
2. The external Web server rejects the connection because there is no ADFS authentication Token, the user is then redirected to the external ADFS Resource Partner.
3. The user is redirected to its own organisation’s internal federation service.
4. The ADFS server authenticates the user credentials to active directory.
5. The ADFS server provides the user with the signed security token and a set of claims for the external ADFS resource partner.
6. The corporate user connects to the resource partner federation service where the token and claims are verified.
7. The user gain access after presenting the new security token to the resource for access.
Summary
The KEMP LoadMaster can be deployed to load balance ADFS 2.0 Servers, Proxy Farms and provide high availability, better performance and scalability as ADFS requires Transport Layer Security and Secure Sockets Layer (TLS/SSL). The Hardware Load Balancing will provide the functionality to test the application or the service connectivity. A greater range of scheduling methods (Least connection preferred)
References
The Role of the ADFS Configuration Database
ADFS 2.0 High Availability Installation
