Checklist: Configuring the Account Partner Organization

Article
07/02/2012

Applies To: Windows Server 2008

This checklist includes tasks for deploying Active Directory Federation Services (AD FS) in the account partner organization. It also includes tasks for configuring the components that are required to establish one-half of a federation partnership.

If you are deploying a Web SSO Design, you do not have to follow this checklist. However, you do have to complete the tasks in this checklist to successfully deploy a Federated Web SSO Design or Federated Web SSO with Forest Trust Design.

Important

Make sure that the administrator in the resource partner organization follows the guidance in Checklist: Configuring the Resource Partner Organization to ensure that all necessary deployment tasks will be completed to successfully create the second half of the federation partnership.

Note

Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist.

Checklist: Configuring the account partner organization

	Task	Reference
	Based on your deployment goals, review information about the components that are required to provide users with access to the federated applications that you host in your organization.	Provide Federated Access for Your Employees on the Corporate Network Provide Federated Access for Your Remote Employees on the Internet Provide SSO Access for Customers to Your Hosted Applications
	Determine which AD FS design this account partner organization will be associated with.	Web SSO Design Federated Web SSO Design Federated Web SSO with Forest Trust Design
	To effectively plan and implement the physical topology for the account partner deployment, determine whether your AD FS design requires one or more federation servers or federation server proxies.	Checklist: Installing a Federation Server Checklist: Installing a Federation Server Proxy
	After you deploy the first federation server in the account partner organization, configure the trust policy. You can do this manually or through a policy file that is provided to you by the administrator of the resource partner organization.	Add a New Resource Partner by Manually Configuring the Trust Policy Add a New Resource Partner by Importing an Existing Policy File
	Determine whether you want to implement privacy settings on resource partners in the Federation Service. When you enable enhanced identity privacy settings, you remove sensitive data from claims that are sent to the resource partner organization.	Review How AD FS May Affect Privacy Enable Enhanced Identity Privacy
	If you are deploying the Federation Web Single-Sign-On (SSO) with Forest Trust design, configure the Federation Service for Windows trust.	When to Enable Windows Trusts Configure a Resource Partner to Use Windows Trust
	Incoming claims must be associated with organization group claims or custom claims in the Federation Service. Create organization group claims or custom claims.	Create an Organization Group Claim or Custom Claim
	Create outgoing claim mappings for each resource partner in the Federation Service so that organizational claims will be transmitted to resource partners.	Create an Outgoing Group Claim or Custom Claim Mapping
	Determine the type of account store that you need to add to the Federation Service. Then, create the appropriate group or custom claim extraction to map an organization claim to an Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS) group or user account.	Add an AD DS Account Store Add an AD LDS Account Store Map an Organization Group Claim to an AD DS Group (Group Claim Extraction) Map an Organization Group Claim to an AD LDS Attribute and Value (Group Claim Extraction) Map an Organization Custom Claim to an AD DS or AD LDS User Attribute (Custom Claim Extraction)
	Prepare client computers for federation by: Adding the URL for the account federation server to the trusted sites list for the client browser. Using Group Policy to push the appropriate Secure Sockets Layer (SSL) certificates to client computers.	Prepare Client Computers for Federation Configure Client Computers to Trust the Account Federation Server Distribute Certificates to Client Computers Using Group Policy

Checklist: Configuring the Account Partner Organization

Additional resources