与内部 AD 用户和外部用户进行 SSO 的最佳方法是什么？
我们有一个 Web 应用程序 (asp.net mvc 3)，它应该支持通过 AD 供内部使用的 SSO。我们还有一个大型外部用户社区，我们希望为所有 Web 应用程序提供 SSO。例如：external_user1 使用相同的登录名访问 webappA、webappB 和 webappC。此外，domain\user1 可以访问所有三个 Web 应用程序。我们计划使用 WIF 和 ADFS 2.0。
我们不希望所有外部用户都拥有 AD 帐户，因此，过去我们可能尝试过使用 ADFS 1.x 和 ADAM 的解决方案。但是，我们在 Windows Server 2008 R2 和 ADFS 2.0 上无法使用 AD LDS（ADAM 的继承者）对用户进行身份验证。
什么是 SSO 方法（使用微软产品）？
We have a web application (asp.net mvc 3) that should support SSO for internal uses via AD. We also have a large community of external users that we want to have SSO for all of our web applications. for example: external_user1 accesses webappA, webappB and webappC all with the same login. Also, domain\user1 has access to all three webapps. we plan to use WIF and ADFS 2.0.
We don't want to have AD accounts for all of the external users so, in the past we might have tried a solution with ADFS 1.x and ADAM. however, we're on Windows Server 2008 R2 and ADFS 2.0 cannot use AD LDS (successor to ADAM) to authenticate users.
What is the SSO approach (using microsoft products)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
关键问题是您是否可以利用 external_user1 帐户存储。如果可以的话，那么您只需要在 ADFS 与其 STS 之间添加另一个信任关系即可完成！这种方法是理想的，因为这样您就不再需要维护 external_user1 了。本质上是这样的：
如果您无法利用他们的用户帐户，那么您仍然可以使用 ADFS v1.1并相信自己：
The key question is whether you can leverage external_user1 account store or not. If you can, then you would just need to add another trust relationship between your ADFS and their STS and you are done! That approach would be ideal, because then you would not need to maintain external_user1 anymore. Essentially this:
If you can't leverage ther user accounts, then you can still use ADFS v1.1 and have a trust with yourself:
您是否无法创建一个允许针对 ADAM 进行身份验证并与 ADFS v2.0 具有信任关系的自定义 STS？
Could you not create a custom STS that does allow authentication against ADAM and that has a trust relationship with ADFS v2.0?
除了 Eugenios 的回答之外，您还应该研究 Microsoft Azure ACS。这将为您提供 Google、Facebook、Yahoo 和其他 OpenId 提供商的联盟。
您的身份验证链将如下所示：
您的应用程序 -> ADFS->活动目录
或者
您的应用程序 -> ADFS-> ACS->谷歌。
在本站搜索ADFS标签，你会发现很多相关的帖子。
In addition to Eugenios answer, you should investigate Microsoft Azure ACS. This will give yo you federation of Gooogle, Facebook, Yahoo and other OpenId providers.
Your authentication chain will look like this:
Your App -> ADFS -> Active Directory
or
Your App -> ADFS -> ACS -> Google.
Search for the ADFS tag in this site, and you will find many relevant posts.
虽然这个问题是针对 ADFS 2.0 的，其中对 LDS 作为身份提供者的支持已被删除，但看起来这将在 ADFS 4.0 中重新引入
https://technet.microsoft.com/en-us/library/dn823754.aspx
https://jorgequestforknowledge.wordpress.com/2014/10/20/configuring-a-new-identity-store-as-a-claims-provider-in-adfs/
Though this question was for ADFS 2.0, in which support for LDS as an identity provider was dropped, it looks like this will be re-introduced in ADFS 4.0
https://technet.microsoft.com/en-us/library/dn823754.aspx
https://jorgequestforknowledge.wordpress.com/2014/10/20/configuring-a-new-identity-store-as-a-claims-provider-in-adfs/