Name resolution requirements for federation servers

Applies To: Windows Server 2003 R2

When clients on the corporate network attempt to access an Active Directory Federation Services (ADFS)-secured application, they must first authenticate to a federation server. One way to authenticate is to have the corporate network clients access a local federation server through Windows Integrated authentication.

Configure corporate DNS

So that successful name resolution through Windows Integrated authentication on local federation servers can occur, Domain Name System (DNS) in the corporate network of the account partner must be configured for a new host record that will resolve the fully qualified domain name (FQDN) host name of the federation server to the IP address of the federation server cluster.

In the following illustration, you can see how this task is accomplished for a given scenario. In this scenario, Microsoft Network Load Balancing (NLB) provides a single cluster FQDN name and a single cluster IP address for an existing federation server farm.

For information about how to configure a cluster IP address or cluster FQDN using NLB, see Specifying the Cluster Parameters (https://go.microsoft.com/fwlink/?LinkId=75282).

For information about how to configure corporate DNS for a federation server, see Add a host (A) record to corporate DNS for a federation server.

For information about how to configure federation server proxies in the perimeter network, see Name resolution requirements for federation server proxies.