Active Directory Federation Services (AD FS)

Historically, AD FS has been Microsoft’s solution to federated authentication. AD FS tightly integrates with AD DS by acting as a sort of protocol translator that allows federated applications to use modern protocols, while, under the hood, actually authenticating the users against AD Domain Controllers through Windows authentication (Kerberos or NTLM) without the application being aware of where the user’s credentials are stored.

The infrastructure of AD FS is very simple and is made up of a pair of server roles: AD FS servers and AD FS proxy servers. The former are installed within a company’s internal network and provide their functionality, including single sign-on (SSO), to users connecting from within the organization premises or connected through a virtual private network (VPN). The latter are typically installed in a demilitarized zone (DMZ) network, which is logically separated from the internal network and...