InfoWorld review: Microsoft ADFS 2.0 and Forefront Identity Manager 2010

To get started with ADFS, make sure you have a valid SSL certificate (self-signed is sufficient but not recommended for a production environment), Windows Server 2008 R2, Microsoft SQL Server 2008 (for the policy store), and Active Directory Domain Services. The ADFS 2.0 software is available as a free download from Microsoft through the Download Center.

Setting up ADFS takes quite a few steps, most of which involve importing the SSL certificate, exporting certificates, and creating shared certificates. Each ADFS server has to import the other's SSL certificate in order to authenticate the external lookup request. The end result is that a trust relationship between the two federation servers (Security Token Services) is established using SOAP messages and SAML metadata. The last step is generating the claims rules appropriate for the exposed resource.

Claims rules can come in many forms and vary greatly based on the target resource or application. For the most part, each rule or policy must know the Uniform Resource Identifier (URI) of the application, which claims are being offered, which claims the application requires, the URL the application should expose to the user, and finally, if the token should be encrypted or not. Some rules might require user name, email address, and group affiliation, while others may only need first and last name. Rules can simply pass information through to ADFS or transform the data into something recognizable. For example, if ADFS talks to an LDAP server, it might need to reformat the user name so that the other ADFS (or Security Token Service) can properly process it. ADFS provides a very flexible rule engine that can handle most every situation.

Active Directory Federation Services is a great way to extend trusted authenticated access between domains using claims-based authentication. The fact that it works with other open Web standards allows it to extend its reach into non-Microsoft domains, while still allowing trusted access and single-sign-on capabilities. It does require a little work to get set up, but once in place, the benefits really pay off.

Forefront Identity Manager 2010
Forefront Identity Manager 2010 is a powerful platform for managing user identities, credentials, and identity-based access policies for both Windows and non-Windows environments. In FIM 2010, Microsoft took smart card and certificate management and merged it with identity lifecycle tools to streamline administration and improve user security and compliance. FIM 2010 also empowers users through self-service tools to manage their own group memberships or reset their user password from the Windows logon page. FIM 2010 is based on Web standards for greater extensibility and will work with third-party certificate authorities.

To get a feeling for how FIM 2010 fits into a real-world situation, I tested it in a highly virtualized environment made up of Active Directory domain controllers, SharePoint 2007 servers, Exchange 2007 servers, and two FIM 2010 and ADFS 2.0 servers in two domains, for a total of 13 virtual clients and servers. I was able to create and execute FIM 2010 policies on one server and see the results across both domains. I found the SharePoint-based UI easy to use, and after a couple of false starts, I had little trouble with the policy engine. The workflow wizard did a good job of walking me through workflow generation even though I had never created a workflow before.