Provide federated access for your remote employees on the Internet

Applies To: Windows Server 2003 R2

This deployment goal builds on the deployment goal that is described in Provide federated access for your employees on the corporate network. It also makes it possible for remote employees to obtain Active Directory Federation Services (ADFS) tokens from the account federation server. After it obtains the tokens, the remote employee's client computer can use the ADFS tokens to gain federated access to ADFS-secured applications that are hosted in another organization and allow employees to access resources in their own organization.

For more information, see Federated Web SSO design.

For example, A. Datum Corporation may want remote employees to have federated access to ADFS-secured applications that are hosted in Trey Research, without requiring A. Datum employees to be on the A. Datum corporate network.

In addition to the foundational components that are described in Provide federated access for your employees on the corporate network (which are shaded in the following figure), the following components are required for this deployment goal:

• Account federation server proxy: Employees that access the federated application from the Internet can use this ADFS component to perform authentication. By default, this component performs forms authentication, but it can also perform basic authentication. You may also configure this component to perform Secure Sockets Layer (SSL) client authentication if users at your organization have certificates to present. For more information, see Where to place a federation server proxy.

• Perimeter DNS: This implementation of Domain Name System (DNS) provides the host names for the perimeter network. For more information about how to configure perimeter DNS for a federation server proxy, see Name resolution requirements for federation server proxies.

• Remote employee: The remote employee accesses an ADFS-secured Web application through a supported Web browser, using valid credentials from the corporate network, while the employee is offsite using the Internet. The employee's client computer in the remote location communicates directly with the federation server proxy to generate a token and authenticate to the application.

The following illustration shows each of the required components for this ADFS deployment goal.