network programming art, and assumes that the reader either is familiar with the aforementioned material or has immediate access to it. Abstract This document provides an overview of the functionality and relationship of the Active Directory Federation Services (AD FS) protocols. AD FS provides a means for distributed identification, authentication, and authorization across organizational and platform boundaries. It extends the ability to use functionality that is normally available only within a single security or enterprise boundary to Internet-facing applications, which gives customers, partners, and suppliers a streamlined user experience while accessing the web-based applications of an organization. The AD FS protocols that are described in this document provide for tasks such as sharing of among groups of AD FS servers, obtaining for users from , and integrating AD FS with proxies. These protocols include , , , , , , , and , along with various industry standards. This document describes the intended functionality of the AD FS protocols and how the protocols interact with each other. It provides examples of some common use cases. It does not restate the processing rules and other details that are specific for each protocol. Those details are described in the specifications for the protocols and data structures that belong to this group.
and trust relationships. Security token generation Federation Service (AD FS) Proxy Protocol Provides a means for a proxy located outside a protected network to communicate with an STS located inside the protected network. Security token generation Security Assertion Markup Language (SAML) Proxy Request Signing Protocol Used by a proxy located outside a protected network to communicate with an STS located inside the protected network. Security token generation Active Directory Federation Service (AD FS) Web Agent Protocol Enables a to obtain information about an STS. OAuth authorization code processing The OAuth 2.0 Authorization Framework Allows the owner of a protected resource or service to grant access to that resource or service. OAuth authorization code processing Active Directory Federation Services OAuth Authorization Code Lookup Protocol Allows AD FS servers that are deployed in an AD FS farm configuration to share OAuth authorization codes. authorization code processing OAuth 2.0 Protocol Extensions Specifies mandatory extensions to [RFC6749] (the OAuth 2.0 Authorization Framework). Integration of AD FS with Active Directory Federation Implements a that publishes
proxies Services and Proxy Integration Protocol application services that are located inside the boundaries of a corporate network and orchestrates authentication for clients that are outside that boundary (that is, single sign-on (SSO) The Web Services Federation Language Mechanisms to allow federation of disparate security so that existing authentication and authorization information can be leveraged. single sign-on The Web Services Federation Language Version 1.2 A profile to describe how passive requestors such as web browsers can use mechanisms. Device Registration Device Registration Discovery Protocol and Device Registration Enrollment Protocol Provides for discovery and utilization of information that is needed to register personal or devices with a workplace. and Public Key Authentication Public Key Authentication Protocol Allows HTTP clients to prove possession of a private key without having to rely on typical client authentication support from the underlying platform.
Protocol syntax refers to data elements (such as packets, structures, enumerations, and methods) as well as interfaces. Protocol revision refers to changes made to a protocol that affect the bits that are sent over the wire. The changes made to this document are listed in the following For more information, please contact . Section Tracking number (if applicable) and description change (Y or N) Change type Functional Description Updated content for Windows 10 and Windows Server 2016 Technical Preview. Y Content update. 2 Functional Description information about Device Registration protocols. Y Content update. Summary of Protocols Updated content for Windows 10 and Windows Server 2016 Technical Preview. Y Content update. 2.1 Summary of Protocols Added information about Device Registration protocols. Y Content update. Components and Capabilities Updated content for Windows 10 and Windows Server 2016 Technical Preview. N Content update. Added information about Device Registration protocols. Y Content update.