4. Key Point: Federation relationships are based on trust

6. SharePoint Federation Gateway

7. Multiple, Unique, Dynamic Temporal Single, Instance specific, Dynamic Single, Unique, Static, Stable http://schemas.xmlsoap.org/.../upn http://schemas.xmlsoap.org/.../emailaddre ss http://schemas.xmlsoap.org/.../upn http://schemas.xmlsoap.org/.../emailaddre ss http://schemas.microsoft.com/.../role http://schemas.xmlsoap.org/.../Group http://schemas.microsoft.com/.../groupsid http://schemas.microsoft.com/.../role http://schemas.xmlsoap.org/.../Group http://schemas.microsoft.com/.../groupsid http://schemas.microsoft.com/... /authenticationinstant http://schemas.microsoft.com/... /authenticationmethod http://schemas.microsoft.com/... /authenticationinstant http://schemas.microsoft.com/... /authenticationmethod

8. Identify Authentication and provisioning AD ADFS Public (other) Perform Claims Rationalization (Families) ID’s Roles Groups Define SharePoint Container Security Web App Policies Site Security

10. URL’s and Federation Realms Explicit Allow or Deny Web Application Policy on zone Explicit Allow SP Groups Direct Permission

11. Internal authentication AD for corporate users (AD) Extranet with external authentication Collaboration by Role Incoming Groups Mapped to Roles Separating by Roles (Sales, Legal and Portal Users) Audience: Private Federation for Partners (ADFS) Read Only + Audience: Consumer ID for customers (Live, G.., FB)

12. Private Federation with ADFS

13. SharePoint Federation Gateway

15. i:0#.w|domain\sAMAccountName 1: “I” for identity claim (user unique identifier) 3: Reserved as 0 (to enable more claim types in the future) Claim value6: Issuer W=Windows 4: Claim Type encoded value (#=User Logon Name) ClaimType : Value: Value Type: OriginalIssuer : http://schemas.microsoft.com/sharepoint/2009/08/claims/userlogonname domain\saMAccountName http://www.w3.org/2001/XMLSchema#String Windows

16. 1: “I” for identity claim (user unique identifier) 3: Reserved as 0 (to enable more claim types in the future) Claim value6: Issuer Type T=Trusted 4: Claim Type encoded value (e=UPN) Original Issuer name: Name of membership role provider, name of trusted STS ClaimType : Value: Value Type: OriginalIssuer : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn user@domain.tld http://www.w3.org/2001/XMLSchema#String TrustedProvider:fedpartner

17. 1: C for Claim 3: Reserved as 0 (to enable more claim types in the future) Claim value 6: Issuer S=SharePoint STS 4: Claim Type encoded value (‘(‘ = IsAuthenticated) ClaimType : Value: Value Type: OriginalIssuer : http://sharepoint.microsoft.com/claims/2009/08/isauthenticated true http://www.w3.org/2001/XMLSchema#String SecurityTokenService

18. C for Claim3: Reserved as 0 (to enable more claim types in the future) Claim value6: Issuer Type T=Trusted 4: Claim Type encoded value (“Next” ASCII Char) Original Issuer name: Name of membership role provider, name of trusted STS http://myschema.com/claims/2009/09/usertype TrustedPartner http://www.w3.org/2001/XMLSchema#String TrustedProvider:fedpartner ClaimType : Value: Value Type: OriginalIssuer :

19. Internal authentication AD for corporate users (AD) Extranet with external authentication Collaboration by Role Incoming Groups Mapped to Roles Separating by Roles (Sales, Legal and Portal Users) Audience: Private Federation for Partners (ADFS) Read Only + Audience: Consumer ID for customers (Live, G.., FB)

20. Public Federation with Azure

21. Internal authentication AD for corporate users (AD) Extranet with external authentication Collaboration by Role Incoming Groups Mapped to Roles Separating by Roles (Sales, Legal and Portal Users) Audience: Private Federation for Partners (ADFS) Read Only + Audience: Consumer ID for customers (Live, G.., FB)

22. Custom Claims Provider

23. Internal authentication AD for corporate users (AD) Extranet with external authentication Collaboration by Role Incoming Groups Mapped to Roles Separating by Roles (Sales, Legal and Portal Users) Audience: Private Federation for Partners (ADFS) Read Only + Audience: Consumer ID for customers (Live, G.., FB) BONUS – FB Group Claim Provider

24. SharePoint Federation Gateway