ADFS - Active Directory Federation Service - Claim provider Trust | 2023

[@alokdubey4085]

It was a very informative tutorial, thanks a lot. Few things I am highlighting: 1. Very good communication (clear, concise and grammatically correct). 2. Deck animation is very good. 3. Not in hurry to blabber more n more information in less time. 4. Contents and lab demos are awesome. 5. Before starting a new video, you give a recap of previous videos which kinda help me in recollecting what I learnt in previous videos.

[@kundan0294]

yes you are right... in short simply awesome..

[@tyronemendez7791]

I really appreciate how you teach: speaking slow and repeating work flows. Super helpful!

[@ConceptsWork]

Glad it was helpful!

[@jonathanaguero2537]

Your videos saved me in 2017, now in 2024 they saved me again. Thank you so much!

[@ankurdu7376]

Amazing series and you are a great teacher. Helped me understand the AD FS concepts quickly. This channel deserves audience

[@ConceptsWork]

Glad you think so!

[@jreach4487]

Nice job, sir!

[@ca2997]

Awesome video!! Are you going to do the Authorization rules video soon?? thanks !!

[@DeepakKumarpark]

Clearly explained, pls make videos on ADCS

[@graceyin39]

Great video. Very clear explanations. Thank you very much for your posts!!!

[@ConceptsWork]

Glad it was helpful!

[@Birendravideos]

thanks dear for such video it's great content

[@hiramdante]

Very clear explanation and helpful content. Gracias y saludos!

[@ConceptsWork]

Glad it was helpful!

[@rsdeb2006]

Awesome sir..

[@nedunchezhians8808]

Awesome Video

[@thepurrfectcat]

17:24 why did you select the Send LDAP attribute as claims and later edited it using the claims language, Is this done incorrectly ?

[@ConceptsWork]

No there is nothing wrong, in both the scenarions the claim rules are created for different entities. At 17:24 the rule is created for relying party, where later the rule is created at claim provider trust. The rule created at the end will inforce the query of claims in the token.

[@thepurrfectcat]

@@ConceptsWork I'll check again

[@roberthatcher6308]

You seem to be going faster and faster in your speech and mouse movements. Please slow down to your original speed sir. Overall this is very well presented, clear and consise.

[@ConceptsWork]

Will focus now on our new videos, thank you for the feedback..! Much Appreciated.

[@sahilkashyap2798]

Hello Sir, Hope this message finds you well. Thank you for your kind help and support. All the training videos are too good for us and help us in work. We would request you to please provide us with "Active Directory Certificate Services" playlist as it was promised by you on your one of the training videos. If possible, please provide us with that playlist. Thank you. May God Always Bless you.

[@ConceptsWork]

Thank you sahil for watching our content, ADCS is parked for now, we are completely focused now on security products of Microsoft.

[@ramkumargupta9628]

Great explanation, I would like to confirm here is there any trust configured already between both the domain.

[@ConceptsWork]

No there is no trust between both the Active Directory.

[@soumyadeepbhattacharya9510]

Will we still need 2 ADFS servers if there is a forest level trust configured between the domains? Will my ADFS1 can query user object from second domain then or still it should go via app-adfs1-adfs2-ad2 ?

[@joeponnu]

good job

[@RaviGupta-rr9rj]

What's the role of token encryption certificate here. I understand that this certificate is needed if u have claim provider as ADFS, then the token which send by account partner claim provider trust is encrypted by private key of token encryption cert and using the public key of same cert its decryption by other adfs before sending it to application.

[@anudeep5892]

hello concepts work .the series was very use full I there any way that we can download the presentation? great work...explanation of each terminology and concepts are from ground level any one without any computers background can understand very easily keep the good work @concepts work

[@jeetendragund6218]

Hi I need your help to setup OAuth + ADFS, we are not getting claims

[@kundan0294]

Hi, thanks for the video. at the end of th video you have added claims in claim provider trust by copying query from AD. can we add claim by adding attibute like we did at the time of configuration of RP..

[@jaimansanjay]

Great Thanks!!! a lot.

[@HamidRezaZeinali]

thank you for your clear video. Is it possible to use non active directory and ADFS for authentication ? I want to login to my dynamics CRM on-premises but users are in another Identity Server. can you help me with configuring this ?

[@nagahiteshdesai]

Hello, Thank you again for the videos on ADFS concepts. I have browsed through all the videos you have uploaded, unable to find video on "Claims Language". Request you to create a video on it, "Expect for Send LDap and Custom claims" i have not understood what other kinds of claim rule templates do. If not a video, please point me toward any public documents which can help me understand the claims rules properly. Thank you.

[@ConceptsWork]

Will upload soon

[@aqibmunshi8362]

Great Job Bro. The Best thing about this Series is its Simplicity. However I do have a Question. Is this video true for only On-Prem Applications? because I am guessing if there is an app which is publicly available, we shouldn't be doing Redirects from One ADFS to another. It should just be adding the Federation.xml of Identity Cloud in the application so that it could directly redirect the Auth Request to ADFS of Identity cloud. PS: Correct Me if I am wrong.

[@ConceptsWork]

Completely agreed with you. It all depends upon the authentication flow, that you want to achieve. Some organization develop applications and then provide it as a service, where in there own application is protected by ADFS. This can lead to multiple use cases, likewise for every customer, application must have a different instance. The core agenda for this video was to showcase, how the authentication process is executed between two ADFS servers. Feel free to reach us, for any other query. Thanks..!!

[@tuhinchanak]

@@ConceptsWork I love your videos and I spend most of my study times with your videos. Just to reiterate Aqib Munshi's point for this Account & resource organization scenario, cant this be achieved by adding the Federation.xml of Identity Cloud in the application and then adding a RP trust at Identity cloud ADFS ? So that it could directly redirect the Auth Request to ADFS of Identity cloud as usual?

[@ricardodiaz8719]

very very good!

[@AhmedHassan0987]

I really appreciate your help, I was looking for ADFS explanation, I trust will not find something more clear and to the point like this series I have a question if you allow me to ask, could you please explain the use of each of the following certificates 1) Service communications 2) Token-decrypting 3) Token-signing And which one is used in each step of accessing the Application starting from hitting the Application URL until accessing is permitted?

[@ConceptsWork]

There is a dedicated video explaining the purpose of each cert in this playlist itself.

[@AhmedHassan0987]

@@ConceptsWork I studied all the playlist, which one please, and thanks for replaying

[@m53835]

Nice Content! How to limit the set of users from account forest to access the application at application level? In that case do we need to create matching guest identities in the Resource AD or at application DB?

[@ConceptsWork]

We can create a custom claim rule in ADFS, which will check the DN of the user with the maching domain name and only allow access for a specific domain. Like users exists only in contoso.com should be able to access a particlar application.

[@abhiph6779]

First of all thank you so much for this videos series, I am following the same configuration in home lab ,but while adding a Claim provider trusts through the .XML file , I am getting the error " An error occurred during an attempt to read the federation metadata. Verify that the specific URL or host name is a valid federation metadata endpoint. Please suggest. Thanks in advance

[@ConceptsWork]

Your machine should be able to access the link, try accessing the link from the browser and see, if it works or not.

[@abhiph6779]

@@ConceptsWork Yes, that is accessible.

[@abhiph6779]

@@ConceptsWork do I need to create the forest trust in both domain or need to configure dns forworder? Actually it should not be if we are configured Adfs ...

[@ConceptsWork]

DNS forwarder is not required if you can access the federation metadata. Try manually populating the details.

[@abhiph6779]

@@ConceptsWork Kudos, it's worked perfectly , thanks a lot 🤝☺️

[@manasamanu7710]

I have an doudt about ADFS role,in the organisation maintain differ application and each application have different url, how three or more applications urls will be manage with single ADFS server.

[@manasamanu7710]

Please explain if my question is wrong

[@ConceptsWork]

ADFS is not managing any application URL. Please elaborate your exact doubt.

[@manasamanu7710]

would like to ask about ADFS. We have an ADFS 3.0 server that connects to office 365. I have other apps now that I need to federate. I would like to know can I use the same ADFS server to federate these other applications or do you have to have a separate server for each application. I would assume you can use a single server however most documentation only talks about single app senarios

[@manasamanu7710]

Hi sir

[@priyankareddy3587]

I have a query w.r.t CPT Domain 1 Domain 2 ADFS 1 ADFS 2 User1 App is hosting in domain 2 so when user 1 needs to access APP2 we need to add ADFS 1 as CPT in ADFS2 as we need APP ADFS2 to contact ADFS1 then ADFS1 contacts its AD to issue the token and sent to application. so in this case we need to add APP2 as Relying Party in ADFS1 When we are configuring CPT , we need to add ADFS as CPT in Domain 2 and App as RPT in domain 1 It is always combo of RPT +CPT is my understanding correct

[@ConceptsWork]

No. ADFS2 will be the relying party in ADFS 1. App will sent auth request to ADFS 2--> ADFS2 will route the request to ADFS 1 --> ADFS1 will contact AD --> ADFS 1 will provide a token to ADFS 2 --> Which will be consumed by ADFS 2 --> and a new token will be provided to App.(which will be genrated by ADFS 2)

[@kamaljoshi5445]

Hi, FIrst of all thank you for this tutorial but I am not able to sign into IDPinitiated sing on page. Checked all services are running. DNS service is up and running. Can you please help how can I remediate this?

[@ConceptsWork]

If you are using 2016 or above please check from get-adfsproperties if idp initiated sign on is enabled.

[@ConceptsWork]

learn.microsoft.com/en-us/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-initiatedsignon#enable-the-idp-initiated-sign-on-page

[@MrVinoece]

nice vedio i have been following this adfs series when i triedthe demo i getting error when i tried to connect adfs.identityclouds.com from adfs.conceptwork.com , .when i try to click identity cloud signon it showing this site cant be reached identity cloud.com server ip address could not be found could yu please assist me any thing need to configure.awaiting for your reply

[@ConceptsWork]

You have to make sure, both the server can resolve each other, if you are not able to reach one it can be DNS issue.

[@MrVinoece]

@@ConceptsWork thanks for the info, i solved the issue. Thanks for your quick reply

[@simairtel]

Great videos, what is your twitter handle?

[@maxi23121988]

its not working it says cant find the page,Please help

[@ConceptsWork]

what is not working ?

[@manasamanu7710]

Hi sir I am waiting for your valuable reply