Skip to content

Secure Application Access by using AD FS and UAG – Strong Authentication

February 21, 2011

In the last two posts on this subject I showed to you how to use UAG with Forms Based Authentication and as ADFS Proxy. Todays demonstration shows how to use it with Strong Authentication – Certificate Authentication. The topology in this configuration is very similar to the FBA topology, but it requires additional configuration on the UAG to require certificate authentication and we have to utilize Kerberos Constrained Delegation to access ADFS server. KCD is required because when user authenticates to the UAG portal, he never provides his UserID/Password, so if we want to have SSO then UAG must be able to impersonate user by using KCD, and provide Kerberos ticket on the behalf of the user to the AD FS server.

This demonstration was created to satisfy the following requirements for our fictitious Woodgrove Bank Corp:

  • Woodgrove Bank must provide secure access to documents on its Extranet SharePoint site to remote employees.
  • SharePoint site was designed to accept Claims based authentication.
  • Remote employees must use Smart Cards for accessing the site (certificate authentication). 
  • Limit access to client computers that do not meet the company policy.

As always, for best user experience please watch this demo in Full screen and enable HD. Let me know if you have any questions.

About these ads
One Comment
  1. Mark Gabriel permalink

    Greetings!

    I’m trying to configure UAG with ADFS 2.0 for smart card authentication as you discuss here. I am currently being authenticated, however it prompts me to select the certificate on my smartcard several times during the login process. Do you have any suggestions on how to troubleshoot this scenario?

    Many Thanks,

    Mark Gabriel

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

%d bloggers like this: