Active Directory Federation Services (AD FS) is a Windows Server component that provides federated authentication and Single Sign-On (SSO). AD FS enables users to access various applications and services using a single set of credentials.
Protocols Supported by AD FS for SSO:
SAML (Security Assertion Markup Language) – Used for exchanging authentication data between an Identity Provider (IdP) and a Service Provider (SP).
WS-Federation – Designed for integration with Microsoft products.
OAuth 2.0 – Used for modern mobile and web applications.
OpenID Connect (OIDC) – Adds authentication capabilities on top of OAuth 2.0 for applications requiring login functionality.
There are two options for configuring login to Exchange OWA:
1. Direct Integration:
Configure login to Exchange OWA directly via Hideez Identity Cloud as the Identity Provider using the SAML 2.0 protocol (2-tier architecture: Exchange OWA → SAML 2.0 → Hideez Identity Cloud).
Advantages:
No AD FS required: Eliminates the need for setting up and maintaining AD FS, simplifying the architecture and reducing maintenance costs.
Simpler configuration: Without the additional AD FS component, the setup process is quicker and easier.
Faster access to resources: Direct integration with Hideez Identity Cloud reduces additional steps in the authentication process, providing quicker access to resources.
Reduced latency: The direct integration model may lower response times compared to a multi-step architecture involving AD FS.
Easier scalability: Scaling is simpler, as there’s no need to manage or expand an AD FS infrastructure for new integrations.
2. Through AD FS:
Configure login to Exchange OWA using AD FS with Hideez Identity Cloud as the Identity Provider, utilizing the WS-Federation protocol (3-tier architecture: Exchange OWA → WS-Federation → AD FS → Hideez Identity Cloud).
Advantages:
Leverages existing AD FS infrastructure: If AD FS is already installed and configured, this option allows you to use the existing infrastructure without additional setup or changes.
Integration with other Microsoft applications: If the organization already integrates other Microsoft products via AD FS, this option allows centralized authentication management for all applications, including Exchange OWA and others.
Centralized access policy management: With AD FS in place, you can manage access policies and security measures centrally, ensuring consistent enforcement across all integrated services, including Hideez Identity Cloud.
Enhanced security: AD FS can be configured with additional security features like MFA, enhancing access protection for all connected resources.
Convenient for organizations already using AD FS: This option is ideal for organizations with established AD FS configurations, allowing easy integration of Hideez Identity Cloud as an external identity provider without major infrastructure changes.
Last updated