ADFS Federated Identity Scenario

With Windows Server 2003 R2, Active Directory Federation Services (ADFS) can give users single sign-on (SSO) to a partner’s Web application. Here is a typical scenario:

(1) A user at the account partner navigates her browser to a Web application hosted by the resource partner.

(2) An ADFS Web Services Agent on the resource partner’s Web server, which must be Internet Information Services (IIS) 6.0, looks for a security token. If the user doesn’t have one, it sends the request to the resource partner’s ADFS server.

(3) The resource partner’s ADFS server looks at its list of federated account partners to determine where it needs to send the user to get a security token. The first attempt to access the resource partner’s Web application is called a home-realm discovery. Here, the resource partner’s ADFS server will ask the user to provide some identifying data, such as her e-mail address. On subsequent visits, a cookie will tell the resource partner’s ADFS server which account partner she belongs to.