Deploying ADF fails to provide as a so in a business to business federation is a common scenario.
In this scenario, the organisation that requires access to another organisation's application or service
can manage its own user accounts and define its own authentication mechanisms.
The other organisation can define which applications and services to expose to users outside of the
organization and which claims are to which claims it will accept to provide access to the application.
Through law, replication or server sharing.
In this scenario the organisations must establish a federation trust and then define the rules for exchange
claims between them.
Let's review the following demonstration.
Of the flow of traffic in a federation business to business scenario by using a glimpse of their web
application.
In this scenario, a user was sent through research miles to access a Web based application at a datum
Corp..
The Area First authentication process for this scenario is as follows First, a user a trail research
uses a web browser to establish a st-pierre's connection.
To the web server and ADA to incorporation.
Second, the web application receives the request and verifies the user does not have a valid token
stored in a cookie by the web browser because the the user is not authenticated.
The web application redirects the client to the Federation server at a datum corporation by using an
H2 to be.
302.
Redirect message.
Then the client computer sends an extra to pass the request to the Federation server at ADA Corporation.
The Federation server determines the home realm for the user, and in this scenario, the home realm
is three research.
After that, the web server again redirects the client computer to the Federation server in the user's
home realm.
Which Austrian research?
Then the client computer sends an urge to depress the request to the Trade Research Federation's server.
The six step.
If the user is already assigned into the domain, the Federation server can take the user's Kerberos
ticket and request authentication from entities on the user's behalf by using RW.
If the user is not signed into the domain, the user was prompted for credentials.
Next up, the editors demand controller of some tickets.
The user round sent the success message back to the Federation server alone with all the information
about the user that the Federation server can use to generate the user's claims.
Then the Federation server creates the claim for the user based on the rules defined for the Federation
partner.
The Federation server places the claims data in a digitally signed security token and then sends it
to of the client computer which posts it back to the Federation server at a date and corporation.
The ninth step is that Federation server at any datum corporation validates that the security token
can came from a trusted federation partner.
Next stop, the Federation server at 8:08 a.m. Corporation creates and signs the new token which it
sends to the client computer.
The client computer then sends the token back to the original URL that was requested.
And finally, the application on the web server who receives the request and will it dates the sign
tokens.
The Web server issues the client assertion cookie indicating the authentication succeeded.
The Federation server issues a file based persistent cookie, which is valid for 30 days by default.
It eliminates the home realm discovery step during the cookies lifetime.
The server then provides access to the application based on the claims that the user provides.