ADFS – 포레스트 트러스트의Federated WebSSO시나리오와 제약사항

  • Artigo

???? : ADFS – Federated WebSSO with Forest Trust Scenario and its Limitations

https://blogs.technet.com/askds/archive/2009/09/22/adfs-federated-websso-with-forest-trust-scenario-and-its-limitations.aspx

?????? ??(Adam Conkle)???. ??? ??? ??? ADFS ??? ???? ?????? Federated WebSSO? ??? ? ????? ?? ?????? ???. ??? TechNet ??? ???? ??? ??????.

 

??? ?? ??, ?? ????? ?? AD? ?????? DMZ AD? ?? DMZ ??? ??? ????? ??????. ADFS? ???? ?? ??????? claims-aware? ????. NT ?? ??? ????????, NT ?? ??? ? ????? ??????. ?? ????? ??? SQL ??(???? ????)? Kerberos ??? ????. ? ??????? ??? ??? ?? ?? AD? DMZ AD? ? ??? ??? ??? ??? ?????.

???? ????? ADFS? ??? ????? ?? ???(?? AD)? ??? ???(DMZ AD) ADFS ??? ? ? ??? ?? ???????.

- ?? ???

-??? ???

ADFS? ???? ????? ???? ?? AD? ???? ??????? ??? ?, ?? ??? AD? ??? SID? NT ??? ????? ??? ????? ?? ?????. NT ?? ??? ? ????? ? ??? ?? NT ??? ????. NT ??? ????? ??????? ????? ADFS ??? ?????. ???? ? ??????? SQL? ??? ??? ????. ??? Kerberos? ??? SQL ???? ??? ? ??? ?? ?? ???.

???? ????? Federated WebSSO?? Kerberos ??? ???? Kerberos ???? ??? ??? ??? ???? ???. ?? ??? ??? Kerberos? ?? ??? ????, ???-???? ??? ??? ???? ????? ????? ?? ??? ????. ??? ADFS ??? ??? ???? ???? ????? ???? ????.

? ?? ???? ??, S4U2SELF ??? ???? ?? ??? ???? ?? TGT? ?? ? ????. ??? ??????? ? TGT ??? S_PRINCIPAL_UNKNOWN? ?? ?????.

???? ?????? Federated WebSSO ???? ????, ??? ?? ??? ??? ????.

?? 1 : ??? ??? ??? ??? ????? ?????.

· ?? ??? ????? UPN suffix? ???? ??? ??? ?????? ?? UPN suffix? ?????.

· ?? ??? ?????? ?? ??? ??? UPN suffix? ??? ??? ????? ??? ??? ?????.

· ADFS ???? ??? ?? ??? ?????.

? ??? ??? ? ?? ? ??? ??? ????? ?? ?? ?????.

?? 2 : ?? ??? ????? group-to-UPN ??? ?????.

· ?? ??? ???? ?? group claim? ?????.

· ??? ???? ?? ??? ??? ?????.

· ??? ??? ??? UPN? group claim? ??????.

o ??? ????? ADFS.msc? ???.

o ?? ???? ?? ??? ?? ???? ?????.

o ??? ???, UPN Identity Claim? ????, ??? ??? ?? ??? ?????.

o ?? ?? ???? ??? ??? Organizational Claim? ???? ?????.

? ??? ??? ? ?? ? ?? ???? ???? ?? ?? ??? ????. ?? ???? ?? ???? ?? ??? ??? UPN?? ?? ????? ?????.

??? ??? ????? ??? ?? ??? ???, TechNet ??? ?????.

https://technet.microsoft.com/en-us/library/cc779214(WS.10).aspx

????? ?????, ???? ????? Federated WebSSO ?????? Kerberos ??? ?? ? ??? ???? ????? ? ?????. ADFS ??? ?? ????? Kerberos? ??? ??? ?? ???? ?????? Federated WebSSO? ?????, ??? NT ?? ??? ? ????? ???? ??? ????? ???? ???. ?? ??? ????? ???? ???? ???? ????, ??? ??? ?? ??? ??????.

??? ?????.

Adam “I wish I had cooler t-shirts” Conkle