Lesson 2: Configuring and Using Active Directory Federation Services in .NET

Drawer Code 128 Code Set A in .NET Lesson 2: Configuring and Using Active Directory Federation Services

13. On the Resource Partner Details page, review the information and click Next. This information should be the same information you input when you configured the trust policy properties for the Woodgrove Bank domain. 14. On the Federation Scenario page, ensure that Federated Web SSO is selected and click Next. 15. On the Resource Partner Identity Claims page, ensure that the UPN Claim and the E-mail Claim check boxes are selected and click Next. 16. On the Select UPN Suffix page, ensure that Replace All UPN Suffixes With The Following is selected and that contoso.com is the UPN suffix listed. Click Next. Remember that only one UPN suffix can be used in a partnership even if you can have several in the AD DS forest. 17. On the Select E-mail Suffix page, ensure that Replace All E-Mail Suffixes With is selected and that contoso.com is the e-mail suffix that is listed. Click Next. 18. On the Enable This Resource Partner page, ensure that the Enable This Resource Partner check box is selected and click Next. 19. Click Finish to complete the operation. Woodgrove Bank should now be listed as a resource partner. Your implementation is complete.

Because AD FS relies on secure communications, you must ensure that each server in an AD FS partnership trusts the root certificate that was used to issue certificates for each of the servers in the deployment. If you use self-signed certificates, you must export each certificate and then import it in the corresponding server s trusted CA stores. When you configure a partnership, you must first create claims-aware applications and assign specific claims to each partner in the partnership. After the claims have been created, you then identify which directory store will be used by each federation server in the deployment. You create a federation trust between the two partners. This involves preparing the trust policy on each server, exporting the trust policy from the account federation server, and importing it in the resource federation server. Then you can use this trust policy to assign claims to the account organization. To complete the federation trust, you export the partner policy from the RFS and then import it into the AFS. At this point, your partnership has been created.

17

You can use the following questions to test your knowledge of the information in Lesson 2, Configuring and Using Active Directory Federation Services. The questions are also available on the companion CD if you prefer to review them in electronic form.

Answers to these questions and explanations of why each answer choice is right or wrong are located in the Answers section at the end of the book.

1. You are an administrator for the contoso.com domain. Your organization has decided to create a federation partnership with Woodgrove Bank so that you can use identity federation to access a new application in the bank s perimeter network. The federation servers and Federation Service proxies are already in place, but you need to configure the federation trust to enable identity federation. Which steps must you perform (Choose all that apply.) A. Communicate with your counterpart at Woodgrove Bank to establish how you will exchange information. B. Export the partner policy from Woodgrove Bank and import it into Contoso. C. Export the partner policy from Contoso and import it into Woodgrove Bank. D. Export the trust policy from Contoso and import it into Woodgrove Bank. E. Create and configure a claim mapping in Woodgrove Bank. F. Export the trust policy from the Woodgrove Bank and import it into Contoso.

To further practice and reinforce the skills you learned in this chapter, you can perform the following tasks:

Review the chapter summary. Review the list of key terms introduced in this chapter. Complete the case scenario. This scenario sets up a real-world situation involving the topics of this chapter and asks you to create a solution. Complete the suggested practices. Take a practice test.