* Identity federation
One of the major benefits included in Windows Server 2003 R2 is Active Directory Federation Services. This technology allows you to grant access to some of the resources on your network to users or groups from other networks such as your business partners or clients.
Without ADFS, granting access meant extending trust relationships from one forest to another. Many people weren’t happy extending trust relationships from one domain to another (with Windows 2000), so inter-forest trust was almost like asking cold-war U.S. generals to give guided tours of the missile defense system to their Soviet counterparts.
The problem with most Microsoft-style trust relationships is that they’re all or nothing propositions. When you contract with a neighborhood youngster to cut your lawn, you might give him/her a key to the garage in order to facilitate getting out the lawn mower – but you wouldn’t include a key to the Corvette in that garage, would you? Even if the youngster is reliable, why put temptation in their way? That’s how many feel about extending trust relationships.
You could create accounts within your forest for all of your partners’ users who need access, but that’s very time consuming, prone to errors and has its own serious security concerns – how can you be sure that you’re notified when that user’s account is closed? Federation services allow the user to authenticate to their own organization’s network, then (using credentials issued by that network) access resources on your network. When the account is closed, they no longer can access either network.
Identity federation separates authentication (verifying an identity) from authorization (access control) and places it squarely on the account side of the relationship rather than on the resource side. So instead of a user authenticating to an extranet site by entering his credentials, the user’s home Active Directory – otherwise known as his “home realm” – authenticates the user and then automatically generates a security token for the end user. The user then presents that token to a target application, and the application itself uses that token to grant access rights.
This makes for cleaner, easier to use yet more secure access to the resources on your network. It’s probably the major reason to upgrade to R2. There’s just one thing missing.
Are there any non-Windows platforms on your network? Are there any on your partners’ networks? Your customers’ and clients’? Can you be sure that there won’t be any in the future? Come back next week and we’ll look at how to solve these problems.
