70-412 Chapter 20: Implementing Active Directory Federation Services (Ad Fs)

Front 1

allows indentification, authorization, and authentication to occur across organizational boundaries, user are able to use their local credentials to access resources in hosted in another organization or cloud

Back 1

AD FS

Front 2

What are the ADFS Components?

Back 2

#1.Federation Server-has the ADFS role installed, manages request, involving identity claims. #2. Federation Server Proxy- server deployed on the perimeter network when we want to provide AD FS functionality to clients on untrusted networks such as the Internet. This server relays connections to the Federation Server on the internal network. *Can't be the same server as the Federation Server

Front 3

AD FS provide______which works on the basis of a ______ about a user , such as "allow access to this web application if the user is a full-time employee of the partner organization"

Back 3

Claims-based authentication, claims

Front 4

When building tokes that contain claim data, what does ADFS use?

Back 4

#1. Claim-descriptions about an object based on it's attributes. #2.Claim rules- determines how a federation server processes a claim; can a simple rule such as treating a user's email a valid claim, or a job title being translated into a security group membership. #3.Attribute Store- holds the values used in claims,

Front 5

is a federation server that provides users with claims, these claims are stored with digitally encrypted and signed tokens

Back 5

Claims Provider ; When a user needs a token, it contacts the AD deployment in its native forest to determine if the user has authenticated. It then builds a user claim using attributes located within AD and other attribute stores. *Attributes that are added to the claim are dependent on the attributes required by the partner.

Front 6

is a member of AD forest that host the resources that the user in the partner organization wants to access

Back 6

Relying Party ; it accepts and validates the claims contained in the token issued by the claims provider. It then issues a new token that is used by the resource to determine what access to grant the user from the partner organization.

Front 7

Why do we configure the relying party trust on the AD FS server that functions as the claims provider server

Back 7

Because a relying party trust means that a claims provider trusts a specific relying party. "Which resource server are we trusting" hence the key word "Relying Trust Party"

Front 8

Why do we configure the claims provider trust on the Federation Server that functions as the "Relying Party"(Resource Server)

Back 8

Because the claims provider trusts as a statement and means that a relying party trusts a specific claims provider. " Which account server are we trusting " hence the key word "Claims Provider"

Front 9

How do we configure a certificate relationship?

Back 9

#1.Using a 3rd party trusted CA, using an SSL Certificate #2.Configuring CA trusts between partners, we need to import the CA certificate of the partner organization's CA into the TRCA store directly of the AD FS Server, or through AutoEnrollment in Group Policy; and issue a certificate template from ADCS to secure the federation server endpoint

Front 10

What certificates does AD FS use?

Back 10

#1. Token-signing certificates-signs all tokens that it issues; the federation server that functions as the claims provider uses the token-signing certificate to verify its identity. The relying party uses the this ticket to verify it was issued by a trusted federation partner #2.Token-decrypting certificate- The public key from this certificate is used by the claims provider to encrypt the user token. When the relying party server receives the toke, it uses the private key to decrypt the user token.

Front 11

Where can we configure the additional attribute stores besides ADDS, LDAP, or Custom?

Back 11

#1.AD LDS #2.ADAM #3.SQL Server

Front 12

Claims rules determine how AD FS servers consume claims and it supports two different types of claims rules, what are those?

Back 12

#1.Relying Party Trust Claims Rules #2.Claims Provider Trust Claims Rules

Front 13

Claims rules for a relying party trust determine how the claims about a user are forwarded to the relying party. What are the three types of relying party trust claim rules?

Back 13

#1.Issuance Transformation Rules- determines how claims are sent to the relying party #2.Issuance Authorization Rules-determine which users have access to the relying party. #3.Delegation Authorization Rules- determines if users can act on behalf of other users when accessing the relying party

Front 14

Claims provider trust claim rules are set up on the relying party, and determine?

Back 14

how the relying party filters incoming claims

Front 15

How does the AD FS proxy work?

Back 15

They are deployed on the perimeter network as a way to increase security, clients communicate with the server, which then the ADFS Proxy Server communicates with the Internal Federation Server.

Front 16

Give an example of the ADFS Proxy process?

Back 16

The Proxy will forward authentication data from the client to the ADFS Claims Provider of the Federated Trust, and then the Claims Provider confirms the authentication and issues a token, which is relayed back through the proxy to the Relying Party AD FS Server, which also issues a new token that is sent back once more through the proxy to the original client. *The Proxy only forwards, and performs no authentication, and no generation of tokens.

Front 17

Adds an attribute store to the Federation Service.

Back 17

Add-AdfsAttributeStore

Front 18

Adds a new certificate to AD FS for signing, decrypting, or securing communications.

Back 18

Add-AdfsCertificate

Front 19

Adds a claim description to the Federation Service.

Back 19

Add-AdfsClaimDescription

Front 20

Adds a new claims provider trust to the Federation Service.

Back 20

Add-AdfsClaimsProviderTrust

Front 21

Registers an OAuth 2.0 client with AD FS

Back 21

Add-AdfsClient

Front 22

Adds a custom UPN suffix.

Back 22

Add-AdfsDeviceRegistrationUpnSuffix

Front 23

Adds this computer to an existing federation server farm.

Back 23

Add-AdfsFarmNode

Front 24

Adds a relying party trust that represents a non-claims-aware web application or service to the Federation Service.

Back 24

Add-AdfsNonClaimsAwareRelyingPartyTrust

Front 25

Adds a new relying party trust to the Federation Service.

Back 25

Add-AdfsRelyingPartyTrust

Front 26

Adds a relying party trust for the Web Application Proxy.

Back 26

Add-AdfsWebApplicationProxyRelyingPartyTrust

Front 27

Marks the Device Registration Service as disabled on an AD FS server.

Back 27

Disable-AdfsDeviceRegistration

Front 28

Disables an endpoint of AD FS.

Back 28

Disable-AdfsEndpoint

Front 29

Exports the custom configuration of an external authentication provider to a file.

Back 29

Export-AdfsAuthenticationProviderConfigurationData

Front 30

Generates SQL scripts to create the AD FS database and to grant permissions.

Back 30

Export-AdfsDeploymentSQLScript

Front 31

Exports properties of all web content objects in a specific locale to a specified file.

Back 31

Export-AdfsWebContent

Front 32

cmdlet exports a web theme object to a folder. The cmdlet creates necessary folders that correspond to the web theme settings.

Back 32

Export-AdfsWebTheme

Front 33

cmdlet retrieves the global rules that govern all applications that trigger additional authentication providers to be invoked.

Back 33

Get-AdfsAdditionalAuthenticationRule

Front 34

cmdlet gets a list of all authentication providers currently registered in Active Directory Federation Services (AD FS).

Back 34

Get-AdfsAuthenticationProvider

Front 35

cmdlet retrieves web content objects for all authentication providers, or a specified authentication provider in a locale.

Back 35

Get-AdfsAuthenticationProviderWebContent

Front 36

cmdlet displays the global authentication policy, which includes the providers currently allowed as additional providers in the AdditionalAuthenticationProvider property.

Back 36

Get-AdfsGlobalAuthenticationPolicy

Front 37

cmdlet gets all global web content objects or the global web content object that corresponds to the locale that you specify.

Back 37

Get-AdfsGlobalWebContent

Front 38

cmdlet gets all the associated properties for the Active Directory Federation Services (AD FS) service.

Back 38

Get-AdfsProperties

Front 39

cmdlet gets web content objects for relying parties.

Back 39

Get-AdfsRelyingPartyWebContent

Front 40

cmdlet gets the host name, port, and certificate hash for all SSL bindings configured for Active Directory Federation Services (AD FS) and, if enabled, the device registration service.

Back 40

Get-AdfsSslCertificate

Front 41

cmdlet imports custom configuration for an authentication provider from a file.

Back 41

Import-AdfsAuthenticationProviderConfigurationData

Front 42

cmdlet creates a set of claim rules in Active Directory Federation Services

Back 42

New-AdfsClaimRuleSet

Front 43

cmdlet creates a contact person object in ADFS.

Back 43

New-AdfsContactPerson

Front 44

cmdlet creates a new information object for an organization in Active Directory Federation Services

Back 44

New-AdfsOrganization

Front 45

cmdlet creates a Security Assertion Markup Language (SAML) protocol endpoint object.

Back 45

New-AdfsSamlEndpoint