Integrate ADFS ( WS 2019) with an external Identity Provider: check user authorizations / permissions

Giovanni Fleres 216 Reputation points
2020-10-06T16:21:08.877+00:00

Hi,
I have setup an enviroment with an ADFS ( WS 2019) and an external Identity Provider.
My goal is that once a user has been authenticated by the external Identiy Provider that ADFS will query AD to get retrieve his / her permissions (i.e. based on AD Security membership or check if the user is disabled or if the user has been deleted).

Is it supported such scenario ?
Any helps about what I should do ?

Thanks in advance

Giovanni

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,247 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee
    2020-10-06T16:47:19.147+00:00

    Yes it is possible to do that as long as the external identity provider can provide a unique identifier to anchor the user to an object in AD DS. If you have a specific example (with the actual claim types and the logic for the mapping and the group lookup up) we can help you with the rules here.

    By the way, why use an external provider if at the end you are authenticating AD DS user? Why not using the Active Directory claim provider directly?

    0 comments
  2. Giovanni Fleres 216 Reputation points
    2020-10-07T17:34:22.023+00:00

    Hi @Pierre Audonnet - MSFT ,
    Thanks for your help.
    With some luck, I have been able to resolve these issues.

    Regarding your question, I'm using the Identity Provider to introduce a passwordless authentication for AD DS users because passwordless authentication is not available in AD FS natively.

    Thanks,
    Giovanni

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.