Problem Statement AD DB App1 DB App2 AD App4 App6 AD App5 Intranet Extranet Cloud AD App3 DB SSO Separate Sign-in Separate Sign-in Separate Sign-in Separate Sign-in Separate Sign-in Additional Provisioning Additional Provisioning Additional Provisioning Additional Provisioning Additional Provisioning

Claims Framework Your App 4. Send claims trust 2. Look up claims, transform for application 1. Authenticate 3. Return claims Relying Party Client Identity Provider Fed Client (optional)

“Geneva” Framework Your App trust Relying Party Client “Geneva” ServerActive Directory SQLAttributeStoreSQLAttributeStore Windows CardSpace “Geneva”

Windows Identity Foundation Your App trust Relying Party Client Active Directory Federation Services 2.0 Active Directory SQLAttributeStoreSQLAttributeStore Windows CardSpace 2.0

trust Relying Party Frank Miller SharePoint Redirect to STS 1. Attempt access 3. Home realm discovery 4. Redirect to STS 5. Authenticate FabrikamContoso Windows Identity Foundation AD FS 2.0

trust Relying party Frank Miller SharePoint Post claims 7. Post claims 8. Get claims 6. Get claims FabrikamContoso Windows Identity Foundation

From Fabrikam To LOB Application [type == “Role”, value == “Plant Manager”] => issue (type = “Role”, value = “Buyer”); [type == “Role”, value == “Plant Manager”] => issue (type = “Role”, value = “Buyer”); Fabrikam Authority Policy {Role, Plant Manager} To SharePoint [type == “Role”, value == “Buyer”] => issue (type = “Role”, value = “Purchaser”); [type == “Role”, value == “Buyer”] => issue (type = “Role”, value = “Purchaser”); AutoParts Relying Party Policy [type == “Role”, value == “Buyer”] => issue (type = “Role”, value = “Visitor”); [type == “Role”, value == “Buyer”] => issue (type = “Role”, value = “Visitor”); SharePoint Relying Party Policy {Role, Purchaser}{Role, Visitor} Contoso AD FS 2.0 Server {Role, Buyer}

AD FS 2.0 Microsoft Federation Gateway trust Relying party Frank Miller SharePointOnlineSharePointOnline FabrikamMicrosoft Online ExchangeOnlineExchangeOnline CRM Online ……

Front End AD FS 2.0 Frank Miller Windows Identity Foundation Web Application Back End Windows Identity Foundation Web Service 1. Post claims 2. Get claims 3. Send claims trust

STS „Geneva“ Server (Beta 2) Web Service Provider SAP NetWeaver 7.02 Web Service Consumer.NET 3.5 Trust User Mapping in AD/“Geneva“ Server Registration of SAP Enterprise Service as Relying Party in „Geneva“ Server STS Configuration of „Geneva“ Server in SAP Generated Consumer WCF Binding based on Provider Policy

AD FS 2.0 Card Issuance Token Issuance Management APIs and UX Metadata AD FS 2.0 Proxy Token Issuance Proxy Metadata Proxy Internet Client Configuration Database Intranet Client Attribute Stores AD FS 2.0 Components

Active Directory Configuration SQL Cluster Load Balancer Intranet AD FS 2.0 Farm Perimeter Network Proxy Farm All Intranet Servers Domain Joined Load Balancer