AD FS 2.0 on Windows Server: Availability, Features, and Deployment Guide

Table of Contents

Active Directory Federation Services (AD FS) 2.0 serves as a critical component for organizations aiming to streamline user access across diverse applications and organizational boundaries. It empowers IT professionals to establish a robust claims-based infrastructure, facilitating a seamless single sign-on (SSO) experience. This system eliminates the need for users to maintain separate accounts and passwords, whether accessing on-premises applications, resources in partner organizations, or services hosted in the cloud. By centralizing identity management, AD FS 2.0 significantly enhances both user convenience and application security, making collaboration more efficient and access management more secure.

Understanding Active Directory Federation Services 2.0: Key Features¶

AD FS 2.0 fundamentally transforms how users authenticate and access resources, moving beyond traditional credential-based systems to a claims-based model. This architectural shift enables greater flexibility and security in modern, distributed environments. The core strength of AD FS 2.0 lies in its ability to issue claims about a user’s identity, which are then trusted by various applications and services. This system forms the backbone for federated identity, allowing users to authenticate once with their home identity provider and gain access to multiple service providers without re-entering credentials.

Claims-Based Identity¶

At the heart of AD FS 2.0 is the concept of claims-based identity. Instead of directly authenticating against an application’s user store, a user’s identity is represented by a set of claims (e.g., name, email, role, group membership) issued by a trusted identity provider, such as AD FS. These claims are packaged into security tokens, typically SAML (Security Assertion Markup Language) tokens, which are then presented to relying party applications. This method decouples authentication from authorization, allowing applications to make authorization decisions based on trusted claims rather than managing user credentials directly.

Federation and Trust Relationships¶

AD FS 2.0 facilitates federation by establishing trust relationships between different organizations or identity systems. This involves configuring a claims provider (the organization that authenticates users and issues claims) and a relying party (the application or organization that consumes these claims). Through these trusts, users from one organization can securely access applications hosted by another, fostering seamless business-to-business (B2B) collaboration. The federation service acts as an intermediary, translating and transforming claims as needed to meet the requirements of the relying party.

Single Sign-On (SSO) Capabilities¶

One of the most significant benefits of AD FS 2.0 is its ability to provide a true single sign-on experience. Once a user authenticates with AD FS, they receive a security token that can be used to access multiple federated applications without needing to re-enter their credentials. This dramatically improves user productivity and reduces the cognitive load associated with managing numerous passwords. For IT departments, SSO simplifies help desk operations by reducing password-related support calls and centralizing identity management.

Extranet Access and Security¶

AD FS 2.0 extends secure access to users outside the corporate network, often referred to as extranet access. This is typically achieved through the deployment of a Federation Server Proxy (FSP), which acts as a perimeter network component. The FSP securely relays authentication requests between external users and the internal AD FS server farm, without exposing the internal federation servers directly to the internet. This architecture ensures that sensitive internal resources remain protected while enabling external partners and remote employees to access necessary applications securely.

Integration with Cloud Services¶

Early versions of AD FS, including 2.0, were pivotal in enabling organizations to integrate their on-premises Active Directory with nascent cloud services. By federating identities, AD FS 2.0 allowed users to use their existing corporate credentials to access cloud applications, such as early iterations of Microsoft’s cloud offerings. This capability was instrumental in driving hybrid cloud adoption, providing a consistent identity experience across both on-premises and cloud environments. It served as a bridge, ensuring that identity remained a central, managed asset regardless of where an application resided.

Security and Compliance Enhancements¶

AD FS 2.0 significantly enhances security and aids compliance by standardizing the identity authentication process using established protocols like SAML 2.0 and WS-Federation. All identity information is transmitted through signed and encrypted tokens, protecting sensitive user data during transit. Centralized logging and auditing capabilities within AD FS allow organizations to track access events and maintain a robust audit trail, which is crucial for meeting various regulatory compliance requirements. This unified approach to identity management helps enforce consistent security policies across all federated applications.

mermaid graph TD A[User] --> B(Web Browser); B --> C{Relying Party Application}; C -- Authentication Request (SAML/WS-Fed) --> D[AD FS Federation Server]; D -- Authenticate User --> E[Active Directory]; E -- User Authenticated --> D; D -- Issue Security Token (Claims) --> B; B -- Present Token --> C; C -- Grant Access --> F[Application Resource];
Figure 1: Basic AD FS 2.0 Federation Flow

This diagram illustrates the fundamental process of how a user authenticates through AD FS to access a relying party application. The AD FS Federation Server acts as the trusted intermediary, validating user credentials against Active Directory and issuing claims-based tokens.

System Requirements for AD FS 2.0¶

To ensure a successful deployment and optimal performance of Active Directory Federation Services 2.0, specific system requirements must be met. These prerequisites encompass both the underlying operating system and essential software components. Failing to meet these requirements can lead to installation failures or instability in the AD FS environment.

Supported Windows Server Operating Systems¶

AD FS 2.0 is designed to run on specific versions of Windows Server, ensuring compatibility and leveraging the robust features of Microsoft’s server platforms. The supported operating systems vary slightly between 32-bit and 64-bit architectures, with distinct editions for each.

• Windows Server 2008 R2 (64-bit):

  • Datacenter Edition
  • Enterprise Edition
  • Standard Edition
  • Embedded Solution Edition
  • Small Business Solutions Edition
  • Small Business Solutions EM Edition
  • Small Businesses Server Standard Edition
  • Small Businesses Server Premium Edition
  • Solutions Premium Edition
  • Solutions Edition
  • Solutions EM Edition
  • Foundation Server Edition
  • Small Businesses Edition
  • Essential Additional Edition
  • Essential Additional Svc Edition
  • Essential Management Edition
  • Essential Management Svc Edition

• Windows Server 2008 together with Service Pack 2 (32-bit or 64-bit):

  • Datacenter Edition
  • Datacenter without Hyper-V Edition
  • Enterprise Edition
  • Enterprise without Hyper-V Edition
  • Standard Edition
  • Medium Business Management Edition
  • Medium Business Messaging Edition
  • Medium Business Security Edition
  • Small Business Server Premium Edition
  • Small Business Server Standard Edition
  • Small Business Server Prime Edition
  • Small Businesses Edition
  • Small Businesses Edition without Hyper-V

Essential Software and Hotfixes¶

Beyond the operating system, several software components and hotfixes are crucial for AD FS 2.0 to function correctly. The AD FS 2.0 Setup program is designed to automatically install these dependencies if they are not detected on the system.

• Microsoft .NET Framework 3.5 with Service Pack 1: This framework is fundamental for many Windows applications, including AD FS 2.0. On Windows Server 2008 R2, this component is automatically installed by the AD FS 2.0 setup.
• Windows PowerShell: PowerShell provides a powerful command-line interface and scripting environment, essential for managing AD FS.
• Internet Information Services (IIS) 7: IIS acts as the web server for AD FS, hosting the federation service and various web-based components.
• Windows Identity Foundation (WIF): WIF is a set of .NET classes that provides developers with tools for building claims-aware applications, making it a foundational element for AD FS.
• Software Updates and Hotfixes: Specific updates are required to address known issues and ensure optimal performance and security.
  • For Windows Server 2008 R2: A hotfix rollup (KB981002) for Windows Communication Foundation (WCF) in .NET Framework 3.5 Service Pack 1 is necessary. This ensures proper communication within the AD FS architecture.
  • For Windows Server 2008 SP2: An update (KB973917) implementing Extended Protection for Authentication in Internet Information Services (IIS) is required. This enhances the security posture of the web server components.

Meeting these system and software requirements ensures a stable and secure foundation for your AD FS 2.0 deployment, allowing it to reliably provide identity federation services across your enterprise.

Supported Languages¶

AD FS 2.0 offers broad language support to cater to diverse global deployments, ensuring that administrators and users can interact with the service in their preferred language. This multilingual capability enhances usability and reduces potential barriers for international organizations.

AD FS 2.0 is supported in the following languages:

• Chinese (Simplified)
• Chinese (Traditional)
• Czech
• Dutch
• English
• French
• German
• Hungarian
• Italian
• Japanese
• Korean
• Polish
• Portuguese (Brazil)
• Portuguese (Iberian)
• Russian
• Spanish
• Swedish
• Turkish

Deployment Guide: Planning Your AD FS 2.0 Infrastructure¶

Successful deployment of AD FS 2.0 requires careful planning, considering various architectural decisions, network configurations, and security best practices. A well-designed infrastructure ensures high availability, scalability, and robust security for your identity federation services.

Deployment Topology¶

The choice of deployment topology depends largely on the organization’s size, requirements for high availability, and whether extranet access is needed. Common topologies include:

• Single Server Deployment: Suitable for small organizations or testing environments, where the AD FS server hosts both the federation service and potentially the configuration database (Windows Internal Database). This configuration offers simplicity but lacks high availability.
• AD FS Farm with Windows Internal Database (WID): For small to medium organizations requiring high availability for internal users, an AD FS farm with WID provides fault tolerance and basic load balancing. WID synchronizes configuration data across a limited number of federation servers.
• AD FS Farm with SQL Server: Recommended for larger organizations and those requiring advanced features like token replay detection and higher scalability. Using SQL Server for the configuration database offers superior performance, scalability, and disaster recovery capabilities.
• Federation Server Proxy for Extranet Access: To enable secure access for external users (extranet), Federation Server Proxies (FSPs) are deployed in a perimeter network (DMZ). FSPs protect the internal AD FS federation servers from direct internet exposure by proxying authentication requests.

Network Considerations¶

Proper network configuration is paramount for AD FS 2.0 functionality. Key aspects include:

• DNS Configuration: Correct DNS records are essential for users and applications to locate the AD FS federation service. This typically involves an A record for the federation service name pointing to the AD FS server or load balancer.
• Firewall Rules: Specific firewall ports must be opened between clients and AD FS servers, between AD FS servers and domain controllers, and between AD FS servers and Federation Server Proxies. Common ports include 443 (HTTPS) for client communication and 389/636 (LDAP/LDAPS) for Active Directory communication.
• Load Balancing: For high availability and scalability in a farm deployment, a hardware or software load balancer is necessary to distribute traffic across multiple AD FS servers and Federation Server Proxies. This ensures continuous service even if one server fails.

Certificate Requirements¶

Certificates play a critical role in securing AD FS communications and verifying identity:

• SSL Certificates: A server authentication certificate (SSL/TLS certificate) is required for the AD FS federation service to secure HTTPS communication. This certificate must be trusted by all clients and typically includes the federation service name in its Subject Alternative Name (SAN).
• Token Signing Certificate: Used by the AD FS server to digitally sign all security tokens it issues. This allows relying parties to verify that the tokens originated from a trusted AD FS instance and have not been tampered with. It should be a strong, cryptographically secure certificate.
• Token Decryption Certificate: If AD FS is configured to decrypt tokens from an external identity provider, a token decryption certificate is required.

Service Accounts¶

AD FS 2.0 runs under a dedicated service account. The principle of least privilege should be applied to this account, granting only the necessary permissions. This account needs to be a member of the local IIS_IUSRS group and requires specific permissions to read from Active Directory and access the AD FS configuration database. Using a Group Managed Service Account (gMSA) is recommended for enhanced security and simplified password management in domain environments.

Database Options¶

AD FS 2.0 stores its configuration data in a database. Two primary options are available:

• Windows Internal Database (WID):
  • Pros: Easy to deploy, no additional SQL Server license required, suitable for up to 50 relying party trusts and a limited number of federation servers (typically up to 5).
  • Cons: No support for token replay detection, lacks advanced SQL features, limited scalability, and no built-in reporting.
• SQL Server Database:
  • Pros: Highly scalable, supports larger AD FS farms, offers advanced features like token replay detection, better performance, and robust disaster recovery options. Preferred for large-scale deployments and mission-critical applications.
  • Cons: Requires a separate SQL Server instance and license, more complex to set up and manage.

mermaid graph TD A[Internet User] --> B(External Load Balancer); B --> C[Federation Server Proxy (DMZ)]; C --> D(Internal Load Balancer); D --> E[AD FS Federation Server Farm]; E -- Read Claims Attributes --> F[Active Directory Domain Controller]; E -- Configuration Store --> G[SQL Server Cluster (Optional) / WID]; H[Internal User] --> D; D -- Authentication Request --> E; I[Relying Party Application] --> D;
Figure 2: Typical AD FS 2.0 Deployment Topology with Proxy

This diagram illustrates a common AD FS deployment, showcasing how external and internal users interact with the federation service, including the role of proxies and load balancers for high availability and security.

Deployment Guide: Initial Installation and Configuration Steps (High-Level)¶

The initial setup of AD FS 2.0 involves several key steps to get the service operational. While specific details can vary, the general process includes installing the software, performing initial configuration, and verifying the federation service.

1. Run the AD FS 2.0 Setup Program: Begin by executing the AdfsSetup.exe file on the designated Windows Server. The installer will guide you through the process, including checking for and installing necessary prerequisites.
2. Initial Configuration Wizard: After installation, the AD FS 2.0 Management console will launch an initial configuration wizard. This wizard helps you define whether the server will be a standalone federation server, the first server in a farm, or an additional server in an existing farm.
3. Create a Federation Service: During the wizard, you will create a new federation service. This involves specifying the federation service name (which must match your SSL certificate’s subject name), selecting your SSL certificate, and configuring the service account for AD FS. You will also choose between Windows Internal Database or an existing SQL Server instance for the configuration database.
4. Configure Trust Relationships: Once the federation service is running, you will proceed to configure trust relationships. This involves adding claims provider trusts (e.g., your Active Directory) and relying party trusts (your applications or partner organizations). Each trust defines how claims are issued and consumed.
5. Test the Configuration: After configuration, thoroughly test the AD FS setup to ensure that users can successfully authenticate and access federated applications. This typically involves using a test relying party application to verify the claims flow.

Deployment Guide: Upgrading Your Windows Operating System with AD FS 2.0 Installed¶

When upgrading the Windows operating system on a server where AD FS 2.0 is deployed, it’s important to understand that AD FS 2.0 is automatically uninstalled during the OS upgrade process. Therefore, a specific procedure is required to preserve your AD FS configuration and restore it after the operating system upgrade is complete. This process ensures that your identity federation services resume operation without needing to reconfigure everything from scratch.

Before You Upgrade Windows¶

To safeguard your AD FS 2.0 configuration, it is critical to perform a backup of the service configuration file and note the service account details. These steps ensure that you have all the necessary information to restore your AD FS deployment post-OS upgrade.

1. Locate the AD FS 2.0 Installation Folder: Navigate to the directory where AD FS 2.0 is installed. By default, this is typically %system drive%\Program Files\Active Directory Federation Service 2.0.
2. Back Up the Configuration File: Copy the Microsoft.IdentityServer.Servicehost.exe.config file from the AD FS 2.0 installation folder to a secure backup location on a network share or external storage. This file contains crucial configuration settings for your federation service.
3. Identify the AD FS 2.0 Windows Service Account:
   • Open the Services management console by clicking Start, then Run, typing services.msc, and clicking OK.
   • Locate and right-click on the AD FS 2.0 Windows Service, then select Properties.
   • Go to the Log On tab. Here, you will find the service account name and confirm if a password is required. Make a note of this account name and ensure you have its password readily available. This account is vital for the AD FS service to operate.

These preparatory steps are essential for a smooth recovery of your AD FS 2.0 configuration after the operating system upgrade. Without them, you would have to rebuild your AD FS setup from scratch, which could be a time-consuming and error-prone process.

After You Upgrade Windows¶

Once the Windows operating system upgrade is complete and your server is running the new OS (e.g., Windows Server 2008 R2), you can proceed to reinstall AD FS 2.0 and restore its previous configuration. This involves reinstalling the software, placing the backed-up configuration file, modifying a registry setting, and reconfiguring the AD FS Windows Service.

• Note: Following these steps meticulously will restore the AD FS 2.0 installation to its state before the operating system upgrade, preserving your federation server’s previous configuration data.

1. Reinstall AD FS 2.0: Download and run the appropriate AD FS 2.0 installation package for your newly upgraded Windows operating system (e.g., for Windows Server 2008 R2). Complete the installation process.
2. Restore the Configuration File: Copy the Microsoft.IdentityServer.Servicehost.exe.config file that you backed up in the “Before you upgrade Windows” section (step 2) back into the AD FS 2.0 installation folder (e.g., %system drive%\Program Files\Active Directory Federation Service 2.0). This replaces the default configuration file installed with the new AD FS 2.0 instance.
3. Modify Registry Setting:
   • Open the Registry Editor by clicking Start, then Run, typing regedit, and clicking OK.
   • Navigate to the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adfssrv.
   • On the Edit menu, point to New, and then click String Value.
   • Type InitialConfigurationCompleted and press ENTER.
   • Right-click InitialConfigurationCompleted, and then click Modify.
   • In the Value data box, type TRUE, and then click OK. This registry setting tells AD FS that the initial configuration has already been performed, preventing the wizard from running again and allowing it to use the restored configuration file.
   • Close Registry Editor by clicking File, then Exit.
4. Manage Windows Internal Database (If Applicable): If your AD FS 2.0 deployment uses Windows Internal Database (WID) for its configuration, ensure it is running.
   • Open the Services management console (services.msc).
   • Right-click Windows Internal Database (MICROSOFT##SSEE), and then click Properties.
   • On the General tab, if the Service status is not Started, click Start to initiate the service.
   • Click OK. If you are using SQL Server, bypass this step.
5. Configure and Start AD FS 2.0 Windows Service:
   • In the Services management console, right-click AD FS 2.0 Windows Service, and then click Properties.
   • On the Log On tab, enter the original service account name and password that you noted earlier. This is crucial for the service to have the correct permissions to interact with Active Directory and its database.
   • On the General tab, set the Startup type to Automatic to ensure the service starts with the operating system.
   • If the Service status field does not display Started, click Start to launch the AD FS 2.0 Windows Service.
   • Click OK.

After completing these steps, your AD FS 2.0 installation should be fully restored and operational, leveraging your previous configuration settings. It is advisable to perform thorough testing to confirm that all federated applications and trusts are functioning as expected.

Download Information¶

The necessary installation packages for AD FS 2.0 are available from the Microsoft Download Center. These packages are specific to the Windows operating system and platform architecture.

Package Name	Supported Windows Operating System	Platform	Download File Size
AdfsSetup.exe	Windows Server 2008 R2	x64	24.04 MB
AdfsSetup.exe	Windows Server 2008 SP2	x64	42.64 MB
AdfsSetup.exe	Windows Server 2008 SP2	x86	38.66 MB

These files are regularly scanned by Microsoft for viruses using the most current detection software available at the time of posting. They are stored on security-enhanced servers to prevent unauthorized alterations.

Security and Privacy Considerations¶

Maintaining the security and privacy of an AD FS 2.0 deployment is paramount. As AD FS handles sensitive identity information, it must be protected against various threats. The privacy policies governing AD FS 2.0 align with broader Windows Server privacy statements, ensuring that user data is handled responsibly and in accordance with established standards.

Organizations should implement comprehensive security measures, including:

• Regular Patching: Keeping the operating system, AD FS, and all underlying components (IIS, .NET Framework) up to date with the latest security patches is critical to mitigate known vulnerabilities.
• Strong Authentication: Employing strong authentication methods for accessing AD FS administration interfaces and, where possible, for end-user authentication, enhances overall security.
• Network Segmentation: Isolating AD FS servers and proxies within segmented network zones (e.g., DMZ for proxies) helps limit the blast radius in case of a breach.
• Monitoring and Auditing: Implementing robust logging, monitoring, and auditing of AD FS events helps detect suspicious activities and ensures compliance with security policies.
• Certificate Management: Proper management of SSL, token signing, and token decryption certificates, including timely renewals, is crucial for maintaining trust and secure communication.

For specific details regarding data handling and privacy, refer to the relevant Microsoft Windows Server privacy statements.

Illustrative Video Resource¶

For those who prefer a visual guide or an in-depth walkthrough of AD FS 2.0 concepts and deployment, the following hypothetical YouTube video would be a valuable resource:

Figure 3: AD FS 2.0 Deployment Step-by-Step Guide

This video would offer a comprehensive, step-by-step tutorial on setting up AD FS 2.0 on Windows Server, covering prerequisites, installation, initial configuration, and testing federated access. It would provide practical demonstrations to complement the theoretical understanding of AD FS 2.0’s features and deployment best practices.

Engage with Us!¶

We hope this comprehensive guide to AD FS 2.0 on Windows Server has provided valuable insights into its availability, key features, and deployment considerations. Identity federation remains a cornerstone of modern IT infrastructures, and AD FS 2.0 laid much of the groundwork for current identity management solutions.

Do you have any experiences with deploying or managing AD FS 2.0 that you’d like to share? Perhaps you have questions about specific configurations or troubleshooting tips? Please feel free to leave your comments and questions below. We appreciate your engagement and look forward to fostering a discussion around this important technology!