What is Active Directory Federation Services

  

What is Active Directory Federation Services (ADFS): A simple overview

Active Directory Federation Services (ADFS) is a technology created by Microsoft that allows users to sign on to different applications with single sign-on (SSO). SSO allows a user to log in with a single ID and password to several applications across organizational boundaries. An authentication token is created, and is passed to different applications for seamless logins. Within these tokens are claims about the identity of the user. Therefore, while SSO is the process of authenticating across applications, ADFS is the technology that enables it.

ADFS is usually installed as a component (or role) in a domain controller (DC) running a Windows Server operating system. To do this:

The challenges in a world without ADFS

Web-based applications are the norm everywhere now. Users of these applications can range from a company's own employees, and a third-party's (e.g. a supplier or partner) employees. Thus, there has to be a way to authenticate both internal and external users. ADFS is concerned with the latter.

In a world without ADFS, a user account and credentials will need to be created for external users within the organization's AD forest. However, this will have two main limitations in the long run:

To overcome these limitations, an organization could create a forest level trust between itself and the third-party organization. However, this can lead to privacy issues.

The best solution to this would be to use ADFS. With ADFS, an external user can use their local logon credentials to access authorized resources in their own environment, and then access external resources in another environment, with a single authentication. A trust relationship (or federation) is created between the two environments. The organization to which an external user belongs is called an account organization, and the organization which contains the resource or application that needs to be accessed by the user is called a resource organization.

How does ADFS work: The ADFS architecture

The ADFS architecture is depicted in the diagram below:

Here are the steps of authenticating a user from an account environment in the resource environment using ADFS:

Auditing ADFS with ADAudit Plus

ADAudit Plus is a comprehensive Active Directory auditing solution that can monitor and track all successful and unsuccessful ADFS authentications. Furthermore, it can also track extranet lockouts which, to put it simply, are lockouts that happen when authenticating external users.

To access information about ADFS in ADAudit Plus:

Three reports are available:

The information included in this report includes, but is not limited to:

Going into caller identity gives more information about the user as the example below shows:

Going into issues claims gives information about the claims that were actually used to authenticate the user. Here's a sample screenshot that gives this information:

About ADAudit Plus

ADAudit Plus is a real-time, web-based Windows Active Directory (AD) change reporting software that audits, reports and alerts on Active Directory, Windows servers and workstations, and NAS storage devices to meet the demands of security, and compliance requirements. You can also track ADFS logon successes, ADFS logon failures, and extranet lockouts with ADAudit Plus. In total, the solution has 200+ reports and real-time alerts to keep your network environment secure. To learn more, visit https://www.manageengine.com/active-directory-audit/.