Presentation is loading. Please wait.

Presentation is loading. Please wait.

Ing. Ondřej Ševeček | GOPAS a.s. | MCM: Directory Services | MVP: Enterprise Security | CEH | | |

Similar presentations


Presentation on theme: "Ing. Ondřej Ševeček | GOPAS a.s. | MCM: Directory Services | MVP: Enterprise Security | CEH | | |"— Presentation transcript:

1 Ing. Ondřej Ševeček | GOPAS a.s. | MCM: Directory Services | MVP: Enterprise Security | CEH | | |

2 AD FS  XML over HTTP/S based authentication and "trust"  Replacement for AD trusts  Free download

3 AD FS vs. local user stores  Local user stores  AD LDS (LDAP), SQL, XML, …  you must manage the accounts  you know their passwords  you must reset and unlock and disable  AD FS  leaves account management on the account partner side  you never see their password

4 AD FS principles

5

6

7 Internal partners - most common

8 SharePoint WS Federation passive URL  This is the resulting redirection after client is authenticated and claims are processed and signed  https://intranet.gopas.cz/_trust/

9 SharePoint realm  Used to identify the calling application  it is the thing that SharePoint sends to ADFS to identify itself  urn:something:something-else  urn:intranet.gopas.virtual:sharepoint

10 SharePoint incoming claim types ADFS Incoming Claim Type ADFS Outgoing Claim Type to SharePoint URI ID SAM-Account-NameName IDnameidentifier -Addresses Address address Token-GroupsRolerole Given-NameGiven Namegivenanme Surname surname User-Principal-NameWindows Account Namewindowsaccountname

11 Claim types and SharePoint  Only IdentifierClaim is saved in user's "settings" page  Other claim types can be used to authorize access to resources with People Picker  No lookup for account partner claim values

12 More groups as a single claim  c:[Type == ”http://schemas.microsoft.com/ws/2008/06/identity/claims/ groupsid”, Value == “S ”, Issuer == “AD AUTHORITY”]  && c1:[Type == ”http://schemas.microsoft.com/ws/2008/06/identity/claims/ groupsid”, Value == “S ”, Issuer == “AD AUTHORITY”]  && c2:[Type == ”http://schemas.microsoft.com/ws/2008/06/identity/claims/ groupsid”, Value == “S ”, Issuer == “AD AUTHORITY”]  => issue(Type = “http://schemas.sp.local/canDoIt”, Value = “true”, Issuer =c.Issuer, OriginalIssuer = c.OriginalIssuer, ValueType = c.ValueType);

13 Active Directory Federation Services Ing. Ondřej Ševeček | GOPAS a.s. | MCM: Directory Services | MVP: Enterprise Security | CEH | | |


Download ppt "Ing. Ondřej Ševeček | GOPAS a.s. | MCM: Directory Services | MVP: Enterprise Security | CEH | | |"

Similar presentations


Ads by Google