Provide access to your Partner on your UAG Portal with ADFS 2.0

forefrontsecurity — Tue, 16 Aug 2011 07:58:00 GMT

Hi,

As Hicham already demonstrate, you can add Claims Provider Trust on your Federation Server. His example is a Federation with Azure services, but you can do the same with a Federation Partner. Have a look at this article : http://myitforum.com/cs2/blogs/forefrontsecurity/archive/2011/08/05/authenticating-to-your-network-through-your-online-credentials.aspx

Let’s assume that the Labiam Corporation wants to allow access on his UAG Portal to the UAG.com company. Both have a Federation Service.

As you can see on the above schema, we have to create a Claims Provider Trust on the LABIAM Federation Server, and add this Federation Server as a Trusted relying Party on the UAG.com Federation Server.

With the FederationMetadata URL, it is easy to add this provider

Add the necessary claims to the Provider (Windows Account Name, Role …)

On the other side, create the Relying Party Trust, and accept the required claims.

Now, when a user access the UAG Portal, he can choose his repository, and your Partner can access your publications.

Then you can filter the access to specific application, using the Role Type of Claims (developed in a previous article : http://myitforum.com/cs2/blogs/forefrontsecurity/archive/2011/08/16/ad-fs-2-0-and-uag-set-authorization-on-application-in-uag-based-on-claims-roles.aspx)

AD FS is a very great feature. No matter Network considerations, Active Directory Trust Relationships, just use HTTP(s) Exchange to Federate your Business Partners.

Published by Olivier DETILLEUX

Forefront Security at myITForum : Federation, claims

Provide access to your Partner on your UAG Portal with ADFS 2.0