Identify the type of federated application to deploy

Applies To: Windows Server 2003 R2

As part of the process of designing your deployment, identify the type of federated application that will be secured by Active Directory Federation Services (ADFS). All applications that are secured by Windows Server 2003 R2 ADFS Web Agents must be running under Internet Information Services (IIS) 6.0.

So that they can use ADFS Web Agents, each application must be at least one of the following application types:

• Claims-aware application: Claims-aware applications are Microsoft ASP.NET 2.0 applications that are written so that they can query ADFS security token claims. When a claims-aware application is presented with a valid token, the application can make authorization decisions based on the claims in the token.

• Windows NT token–based application: Windows NT token–based applications use Windows-based authorization mechanisms. These applications require Windows NT security tokens to make authorization decisions. ADFS can enable the transition of an ADFS security token to an impersonation-level Windows NT access token.

The following table shows the differences in requirements for each type of federated application.

Claims-aware applications

When you set up a claims-aware application, all the information about a given identity is contained in the token that is presented by the application. The application may store additional information that links to the identity that is presented in the token, but a user account in Active Directory is not required to access a claims-aware application.

Federated applications that are claims aware should be developed specifically to use the claims that are produced by ADFS. When an application is presented with a valid token, the claims-aware application can make authorization decisions based on the claims in the token.

For more information about how to deploy a claims-aware application, see Checklist: Installing a claims-aware application.

Integrating with Authorization Manager

Claims-aware applications can take advantage of role-based access control applications, such as Authorization Manager. Authorization Manager provides a flexible framework for integrating role–based access control into applications. Administrators who configure claims-aware applications can use Authorization Manager to provide access through assigned user roles that relate to job functions.

Authorization Manager applications maintain authorization policy in the form of authorization stores in Active Directory or XML files. The stores apply authorization policy at run time. For more information about ADFS and Authorization Manager, see When to use Authorization Manager.

Windows NT token–based applications

When you set up a Windows NT token–based application, you can map claims in incoming ADFS tokens to either user accounts or groups in the local Active Directory user store in the resource partner. The user accounts or groups are also known as resource accounts or resource groups. The application then uses the resource accounts or groups to perform authorization. For more information about resource accounts, see When to use resource accounts.

Applications that are protected by Windows Integrated authentication can—in some cases—be enabled as Windows NT token–based applications.

For more information about how to deploy a Windows NT token–based application, see Checklist: Installing a Windows NT token-based application.

Using SharePoint products as federated applications

With ADFS in Windows Server 2003 R2, you can use either Microsoft® Windows® SharePoint® Services, Microsoft Office SharePoint Portal Server 2003, or Office SharePoint Server 2007 as supported federated applications. However, the level of support that ADFS provides depends largely on which SharePoint application that you will deploy.

Using ADFS with previous versions of SharePoint products

Windows SharePoint Services 2.0 and SharePoint Portal Server 2003 are considered to be Windows NT token–based applications as a result of their reliance on basic Windows-based authorization mechanisms. Because these SharePoint products depend on Windows-based access control, certain functionality will not be available when either Windows SharePoint Services 2.0 or SharePoint Portal Server 2003 are used as federated applications.

For more information about which functionality is supported in previous SharePoint products, see article 912492 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=107034).

For more information about how to configure Windows SharePoint Services 2.0 or SharePoint Portal Server 2003 as federated applications in a test lab environment, see the Step-by-Step Guide for Active Directory Federation Services (https://go.microsoft.com/fwlink/?LinkId=49531). This guide also provides instructions for removing unsupported SharePoint functionality that is not provided in the Knowledge Base article.

Using ADFS with current versions of SharePoint products

Windows SharePoint Services 3.0 and Office SharePoint Server 2007 products can be configured as claims-aware applications as a result of their support for membership and role provider authorization mechanisms. Because these versions of SharePoint products can use membership and role-based access control, they do not require that resource accounts be created or used in the resource partner organization to take advantage of the single-sign-on (SSO) capabilities that are integrated into ADFS. This means that you can configure Windows SharePoint Services 3.0 and Office SharePoint Server 2007 as claims-aware applications for use with ADFS by using the SharePoint site administration page to configure membership and role-based access control permissions directly. However, for ADFS in Windows Server 2003 R2 to work smoothly with these SharePoint products, Service Pack 2 (SP2) must be installed on the ADFS-enabled Web server where the SharePoint product is installed.

For more information, see article 920764 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=107036).

For more information about how to configure Office SharePoint Server 2007 as a federated application, see Configure Web SSO authentication by using ADFS (https://go.microsoft.com/fwlink/?LinkID=84805).