In this video from ITFreeTraining, I will look at the different components in Active
Directory Federation Services. In particular, this video looks at what each component does
rather than the features each version of Active Directory Federation Services has. That, I
will leave to a different video.
As shown, the components change depending on which version of Active Directory Federation
Services you are using. However, most of the changes are to the name or the location of
the component.
The first component is Active Directory Federation Services. Windows Server 2012 R2 comes with
version 3 of Federation Services. The most noticeable difference is that Federation Service
is a role only with no separate components. When you install the role, you are not given
the choice to install additional components like in previous versions.
Version 2.1 of Active Directory Federation was included with Windows Server 2012. The
name of the role is "Active Directory Federation Services" and the main component is "Federation
Services". So the main difference between this and version 3 is that the Federation
Service component is now a role rather than a component of a role.
Version 2.0 was an optional download for Windows Server 2008. Version 1.1 was included with
the operating system. Regardless of which version you use, Federation Services is a
component of the Active Directory Federation Services role. So essentially, if you want
to install the main part of Active Directory Federation Services, you would install the
Active Directory Federation Services Role and then select the Federation Service component.
The next component that I will look at is the proxy component. I will have a closer
look at this in a moment, but essentially it is installed on the DMZ and provides communication
between the internet and the Active Directory Federation Server.
In Windows Server 2012 R2, the big change is this component has been moved out of the
Active Directory Federation Services role and into the remote access role. The component
is now called "Web Application Proxy". It still provides the same basic functionality
as it did in the previous versions. In all the previous versions of Active Directory
Federation Services, the component is called "Federation Services Proxy" and is part
of the Active Directory Federation Services role.
The last component that I will look at is the Web Agents. In version 3.0 of AD FS these
web agents have been removed and are no longer available. In version 2.1 and previous versions,
they are available as components of the Active Directory Federation Services role.
In a moment I will have a closer look at the Web Agents, but essentially there is no real
difference between the different versions of AD FS other than a small name change. In
the later version of AD FS the web agents have the version number of 1.1 in the name. So
in effect regardless what the name of the Web Agent is, they perform the same role and
have the same features regardless which version of AD FS you are using. I will now have a
look at some of the functionality of these components.
The first component I will have a closer look at is the Web Application Proxy. This component
is new in Windows Server 2012 R2 and is a component of Remote Access rather than of
the Active Directory Federation Services role. It has the same functionality as Federation
Service Proxy and thus replaces it. The point to remember is that it has the same functionality
but also has additional functionality. For example, it also allows applications to be
published for remote access. This is not a feature that is required with Active Directory
Federation Services but shows that this component can be used for things other than just for
Active Directory Federation Services.
Regardless of what the component is called or where it is found in server manager, it
performs the same basic task. If you consider that Active Directory Federation Services
needs to be on a server that is a member of the domain, an administrator will generally
want to install an Active Directory Federation Server on their internal network.
If you have a user on the internet that needs to access this server in order to obtain claims.
You generally do not want a user directly accessing an internal network from the internet.
In the case of Active Directory Federation Services, this user may not be an employee
from your company.
For this reason, an AD FS Proxy server will normally be deployed between the user (on
the DMZ or the perimeter network) and the internal network. To keep the networks safe,
firewalls are placed between them.
What will happen now is, when the user attempts to contact the Active Directory Federation
Server, they will instead contact the AD FS Proxy Server. The Proxy server will pass the
request onto the Active Directory Federation Server. The federation Server will respond
back to the proxy server. For example if the user was requesting a claim, it would pass
this claim to the proxy server. The proxy server will then send the result back to the
user.
Now that the user has the claim, they can use it to contact a claims aware application
which will most likely be on the DMZ. You can see that the user at no time needs to
contact the Active Directory Federation Server directly. Also, the Active Directory Federation
Server needs to be a member of the domain whereas the AD FS proxy does not need to be
a domain member, which improves security.
It should be pointed out that the user will use the same address to access the AD FS proxy
server as they would have if they were to contact the Active Directory Federation Server
directly. The AD FS proxy server essentially is transparent in the process.
The next component that I will look at is the Active Directory Federation Services Web
agents. These are not available in AD FS 3.0 shipped with Windows Server 20012 R2. If you
are running an earlier version of AD FS you have two web agents to choose from. These
are the Claims Aware Agent and the Windows Token-Based Agent. The name of the component
may be slightly different depending on which version of AD FS you are running. A 3rd party
may also provide their own agent. What they do is as follows.
Let's say you have an application running on a server and this server only accepts NT
security tokens. You also have Active Directory Federation Services running. The problem is
that it creates a security token that has a claim in it. However, it is not an NT
security token. To get around this, you have an agent running in between. This agent will
take a security token issued by Active Directory Federation Services with the claim inside
and change it to an NT security token. This provides a way for claim aware applications
to work with Active Directory Federation Services that only accept NT Tokens.
Windows NT based authentication is quite old now and this is probably why Microsoft removed
this feature. The claims aware agents were usually used with Internet Information Services.
There are different ways to achieve this using different software that was previously not
available, so may also be one of the reasons why Microsoft removed it. The point to remember
is that if you are planning to use AD FS 3.0 these features are no longer available.
Thanks for watching this video from ITFreeTraining; I hope that you found it informative. I hope
to see you in other free videos from us for Active Directory Federation Services and others.
Until then, thanks for watching and see you next time.