In its most general use, AD FS is about relationships between organizations, although variations on that theme are becoming more common. In this most common scenario, high-level AD FS behavior appears to enable the sharing of identity, authentication, and authorization information between organizations. More accurately, AD FS allows the creation of trust between two organizations: the organization with resources or services that are being accessed, known as the resource partner, and the organization that holds the accounts of the clients that are accessing the resources, known as the account partner. Once that trust is established, the resource partner does not need to maintain identity information about external clients that are accessing internal resources. Rather, it can depend on the account partner to apply appropriate security policies to the client accounts being held by the account partner. A major component of AD FS is the . The STS generates and issues , which are used by the account partner to prove the authentication of a client and to express the client's authorization. When a client that is signed into the account partner requests access to a resource or service at the resource partner, the resource partner can expect the account partner to pass on the security token about the client that proves to the resource partner that the client is legitimate. The resource partner then uses the security token to determine whether the client is authorized to access the requested resource or service. A more complete understanding of AD FS can be gained from the following resources: , , , and . The AD FS protocols that are described in this document provide functionality to support AD FS in a variety of These areas include obtaining security tokens for users from an STS, sharing of among groups of AD FS servers, and integrating AD FS with proxies. For more details on the AD FS protocols and how they support AD FS, see section . Prerequisites/Preconditions The protocols described in this document are relevant only if AD FS (or an equivalent implementation) is installed on the servers and the servers are configured to hold a role. For authentication, AD FS requires the use of (hereafter called simply "Active Directory").
In its most general use, AD FS is about relationships between organizations, although variations on that theme are becoming more common. In this most common scenario, high-level AD FS behavior appears to enable the sharing of identity, authentication, and authorization information between organizations. More accurately, AD FS allows the creation of trust between two organizations: the organization with resources or services that are being accessed, known as the resource partner, and the organization that holds the accounts of the clients that are accessing the resources, known as the account partner. Once that trust is established, the resource partner does not need to maintain identity information about external clients that are accessing internal resources. Rather, it can depend on the account partner to apply appropriate security policies to the client accounts being held by the account partner. A major component of AD FS is the . The STS generates and issues , which are used by the account partner to prove the authentication of a client and to express the client's authorization. When a client that is signed into the account partner requests access to a resource or service at the resource partner, the resource partner can expect the account partner to pass on the security token about the client that proves to the resource partner that the client is legitimate. The resource partner then uses the security token to determine whether the client is authorized to access the requested resource or service. A more complete understanding of AD FS can be gained from the following resources: , , , and . The AD FS protocols that are described in this document provide functionality to support AD FS in a variety of These areas include obtaining security tokens for users from an STS, sharing of among groups of AD FS servers, and integrating AD FS with proxies. For more details on the AD FS protocols and how they support AD FS, see section . Prerequisites/Preconditions The protocols described in this document are relevant only if AD FS (or an equivalent implementation) is installed on the servers and the servers are configured to hold a role. For authentication, AD FS requires the use of (hereafter called simply "Active Directory").