Checklist: Installing a Windows NT Token-Based Application

  • Article

Applies To: Windows Server 2008

This checklist includes the deployment tasks for preparing an Active Directory Federation Services (AD FS)-enabled Web server running Windows Server 2008 Standard or Windows Server 2008 Enterprise for the installation of a Windows NT token–based application.

Important

Make sure that you have set up your AD FS-enabled Web server using the guidance in Checklist: Installing an AD FS-Enabled Web Server before you proceed with the tasks in this checklist.

Note

Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist.

Checklist: Installing a Windows NT token–based application

  Task Reference

Review important changes to AD FS since the Windows Server 2003 R2 release, including improved application support.

What's New in AD FS in Windows Server 2008 (https://go.microsoft.com/fwlink/?LinkId=85684)

Review information in the Active Directory Federation Services Design Guide about the role that AD FS Web Agents play in deploying federated applications.

Review the Role of AD FS Web Agents

Review the information in the Active Directory Federation Services Design Guide to understand important concepts that are relevant to designing and deploying federated Windows NT token–based applications.

Designing a Federated Application Strategy

Identify the Type of Federated Application to Deploy

Review information in the Active Directory Federation Services Design Guide to determine whether to use public key infrastructure (PKI) or Service Principal Name (SPN) for the security token protection method.

Determine Your Security Token Protection Method

Based on the needs of your Windows NT token–based application design, determine whether to use the resource account, resource group, or group-to-UPN (user principal name) impersonation method for purposes of authorization.

Checklist: Implementing a Resource Account Mapping Method

Using Internet Information Services (IIS), configure your Windows NT token–based application to enable anonymous access and to use Microsoft ASP.NET 2.0.

Configure IIS to Support a Federated Application

Edit the ADFS Web Agent tabs in IIS to enable the Windows NT token–based agent.

Configure the Windows Token-Based Agent

Use the Add Application Wizard in the Active Directory Federation Services snap-in to add a new Windows NT token–based application entry to the Federation Service.

Note
Before you begin this task, first configure the trust policy in the resource partner organization. If you have not yet created and configured the trust policy in the resource partner organization, complete the tasks in Checklist: Configuring the Resource Partner Organization.

Add a New Windows NT Token-Based Application to the Federation Service

Enable any claims that you want to be sent to the application for authorization purposes.

Note

Before you begin this task, first install the appropriate claims in the resource partner organization.

Enable an Organization Claim for a Federated Application in the Federation Service

(Optional) If your application requires them, you can choose authentication method restrictions for your claims-aware application. By default, an application accepts any authentication method that is provided to it.

Configure Authentication Methods for a Federated Application

(Optional) If your application requires it, you can have the resource federation server sign security tokens using Kerberos or PKI signing schemes. The default token-signing scheme is set to PKI.

Configure the Security Token Protection Method for a Federated Application

To ensure the likelihood of successfully tracking down issues that may occur with your Windows NT token–based application, configure event logging.

Configure Event Logging for a Windows NT Token-Based Application

From a client computer, verify that the Windows NT token–based application can be accessed using Integrated Windows authentication, and verify that anonymous access is enabled.

Verify That an AD FS-Enabled Web Server Is Operational