InfoWorld review: Microsoft ADFS 2.0 and Forefront Identity Manager 2010

Managing user access in businesses today is something like playing traffic cop in an intersection of a thousand roads. From Web-based applications to homegrown programs, from desktop PCs to the latest crop of smartphones, IT has to be able to control access to every sort of resource while allowing users to access them from anywhere and any platform.

A bigger challenge is providing seamless access to applications and systems across corporate or network boundaries. It's no trouble for IT to define and manage user names and passwords on their own network, but it takes more work -- or is nearly impossible -- to extend access to internal systems to numerous external users or to manage local user access to a system outside of their control.

[ Get all the details you need on deploying and using Windows 7 in the InfoWorld editors' 21-page Windows 7 Deep Dive PDF special report. Learn how to put AppLocker, BitLocker to Go, security accounts, and other key Windows 7 security improvements to good use in "The ultimate guide to Windows 7 security." ]

Microsoft has updated Forefront Identity Manager (FIM) 2010 and Active Directory Federation Services (ADFS) to aid IT in applying identity management across domains and business boundaries. Both of these tools are intended to extend user access control across the enterprise; FIM uses a common platform to tie user, certificate, group, and policy management together, while ADFS provides trust accounts between different networks or organizations. Together, they provide a powerful platform for extending user management beyond the company domain or network edge.

Active Directory Federation Services 2.0 Active Directory Federation Services, first available in Windows Server 2003, is now a server role in Windows Server 2008 R2. ADFS is a single-sign-on technology that uses claims-based authentication to validate a user's identity across domains. Normally when the user's account is in one domain and the resource is in another, the resource will prompt the user for local credentials. ADFS eliminates the secondary credential request; the user's identity is validated, and access provided, based on information in the user's home directory.

Through the use of ADFS, it is possible to facilitate a wide range of managed access. It makes it easy for users to access an Internet-accessible application on another company's network or to allow outside contractors access to internal resources for the duration of a specific project. The key advantage is that neither domain need contain any of the other domain's user information; no user information is shared, and each side remains responsible only for its own user management.


A claims-based system, like many others, uses digital tokens that contain information about the user. But unlike a request made directly against Active Directory and generating a Kerberos token, the resource being accessed doesn't interact directly with the user data store. Instead, it talks to a Security Token Service, such as ADFS, which performs the check against the user information store and creates a claims token based on the result of the lookup. The claims token can contain as much -- or as little -- information as needed to access the particular service.

Using claims-based authentication between two different domains requires a Security Token Service in each domain. Each domain's Security Token Service must trust the other one, and based on this trust, a policy is defined that specifies if access is granted or denied to a specific resource. For example, when a user on Network A attempts to access a Web portal on Network B, an authentication request is made to the user's Security Token Service on Network A. After validating the claims for the user against the local user directory, Network A's Security Token Service provides a token to Network B's Security Token Service, which then issues its own token to the requesting user in order to access the Web portal. There is a lot of back and forth behind the scenes, but once the remote domain gets the all-clear from the user's Security Token Service, the user gets a new token as if they were a member of the remote domain.

[ From powerful productivity enhancers to important security safeguards, Microsoft Office 2010 has a number of features that businesses will love. See "Top 10 Office 2010 features for business," "More great Office 2010 features for business," and "PowerPivot for Excel 2010: Power to Excel people." ]

Within a single domain -- such as when you want to extend user access to a cloud service without implementing a direct authentication connection to Active Directory or another user database -- a single Security Token Service will do the job. In addition to supporting claims-aware ASP.Net applications and (through an IIS Web server agent) Windows NT token-based applications on the resource side, ADFS 2.0 can communicate with third-party federation services and cloud services using SAML 2.0.

The great advantage of claims-based authentication -- and ADFS 2.0 -- is that no changes are made to either domain's users and no confidential information is sent between domains. When a claims-based request is made from the resource, it simply performs an "is allowed?" request against the issuing claims server. The claim token returns a Yes or No response regarding the user and nothing more. This gets the application out of the user authentication business. It simply asks a trusted partner if it is OK to allow this person to access its resources. All the heavy lifting is done behind the scenes.

ADFS 2.0: Federation services and user claims There are three role services that make up ADFS: the Federation Service, the Federation Service Proxy, and the Web server agent. The Federation Service is the core of ADFS; it's the part of the system that handles user authentication requests from other federation servers. The Federation Service Proxy runs on a server located in the network's DMZ and proxies an external user authentication request to an internal ADFS server. It collects user credentials from browser clients and sends them on to the ADFS server. The Web proxy agent works with claims-aware (ASP.Net) applications on a website and redirects user login requests to the ADFS server. The Federation Service Proxy and the Web agent are optional and may not be needed in all scenarios.

Active Directory Federation Services 2.0 provides an extensible platform for handling claims-based authorization between local and remote domains. Here we see a list of the claims offered by the ADFS server to any other trusted Security Token Service provider. Each trust can have a different set of claims associated with it, allowing ADFS to fit in any situation.

To get started with ADFS, make sure you have a valid SSL certificate (self-signed is sufficient but not recommended for a production environment), Windows Server 2008 R2, Microsoft SQL Server 2008 (for the policy store), and Active Directory Domain Services. The ADFS 2.0 software is available as a free download from Microsoft through the Download Center.

Setting up ADFS takes quite a few steps, most of which involve importing the SSL certificate, exporting certificates, and creating shared certificates. Each ADFS server has to import the other's SSL certificate in order to authenticate the external lookup request. The end result is that a trust relationship between the two federation servers (Security Token Services) is established using SOAP messages and SAML metadata. The last step is generating the claims rules appropriate for the exposed resource.

Claims rules can come in many forms and vary greatly based on the target resource or application. For the most part, each rule or policy must know the Uniform Resource Identifier (URI) of the application, which claims are being offered, which claims the application requires, the URL the application should expose to the user, and finally, if the token should be encrypted or not. Some rules might require user name, email address, and group affiliation, while others may only need first and last name. Rules can simply pass information through to ADFS or transform the data into something recognizable. For example, if ADFS talks to an LDAP server, it might need to reformat the user name so that the other ADFS (or Security Token Service) can properly process it. ADFS provides a very flexible rule engine that can handle most every situation.

Active Directory Federation Services is a great way to extend trusted authenticated access between domains using claims-based authentication. The fact that it works with other open Web standards allows it to extend its reach into non-Microsoft domains, while still allowing trusted access and single-sign-on capabilities. It does require a little work to get set up, but once in place, the benefits really pay off.

Forefront Identity Manager 2010 Forefront Identity Manager 2010 is a powerful platform for managing user identities, credentials, and identity-based access policies for both Windows and non-Windows environments. In FIM 2010, Microsoft took smart card and certificate management and merged it with identity lifecycle tools to streamline administration and improve user security and compliance. FIM 2010 also empowers users through self-service tools to manage their own group memberships or reset their user password from the Windows logon page. FIM 2010 is based on Web standards for greater extensibility and will work with third-party certificate authorities.

To get a feeling for how FIM 2010 fits into a real-world situation, I tested it in a highly virtualized environment made up of Active Directory domain controllers, SharePoint 2007 servers, Exchange 2007 servers, and two FIM 2010 and ADFS 2.0 servers in two domains, for a total of 13 virtual clients and servers. I was able to create and execute FIM 2010 policies on one server and see the results across both domains. I found the SharePoint-based UI easy to use, and after a couple of false starts, I had little trouble with the policy engine. The workflow wizard did a good job of walking me through workflow generation even though I had never created a workflow before.

A good portion of defining trusts in Active Directory Federation Services 2.0 is spent importing, exporting, and creating certificates through the ADFS management utility.

The previous release, Microsoft Identity Lifecycle Manager 2007, provided a platform for identity synchronization, basic certificate and smart card management, and user provisioning. Forefront Identity Manager 2010 takes these base features and enhances them to reduce the time, effort, and cost of managing a user's account throughout its lifecycle.

One area that got a lot of attention in FIM 2010 is policy management. The administration UI is a SharePoint-based system that uses natural language queries and menu-driven controls to generate rules and policies for managing users. The rules can be applied automatically to other users and groups based on various criteria. For example, you can create a rule to automatically add a new user to a group, issue a one-time password for a smart card, and push the user's email address and telephone number to another user directory while flagging HR to issue a request for a new health insurance policy.

One of the most powerful policy management features is the inclusion of Windows Workflow Foundation (WF). With WF, IT can create a multistep policy to easily automate user management. Workflows can be simple or complex with multiple branches depending on need. During my tests, I was able to create workflows to send approve or disapprove notifications to a specific manager whenever a user account was added to a certain group. FIM 2010 can also import and reuse existing WF-based workflows so that IT doesn't have to re-create the workflow wheel and can speed up deployment.

Another very nice feature in FIM 2010 is that it will synchronize user information between heterogeneous systems. Forefront Identity Manager 2010 integrates with a wide range of systems, including Active Directory, Novell, Sun, IBM, Lotus Notes, Exchange, Oracle and SQL Server databases, SAP, and even flat file systems -- in most cases with no additional software agent installed on the target system. A synchronization service takes care of passing user information in and out of FIM 2010.

A good example of this would be the scenario in which a new user is added to the company. HR creates the new user in FIM 2010. The synchronization service pushes the new user info into the enterprise's Active Directory, and following the workflow, once the manager gives approval, this same user information is then sent to the company's insurance provider (an external system, secured by ADFS) to add them to the health insurance plan.

Note that the synchronization isn't merely a one-way street; when the insurance company creates a new account in their system and assigns the new employee an account ID, that information can be sent back into FIM on a subsequent synchronization and stored in the employee's AD record or in FIM 2010 alone. Any update to the user record in any of these systems -- FIM 2010 or AD or the external insurance system -- is automatically updated in the others. With the multibranch capabilities of the policy engine, one change can create a cascade effect on other pertinent systems.

1 2 Page 1
Page 1 of 2
It’s time to break the ChatGPT habit
Shop Tech Products at Amazon