The adfs tag has no wiki summary.
2
votes
0answers
184 views
What are the security concerns with turning off Extended protection for authentication in IIS7 on ADFS?
In setting up SSO for Office 365, in order to make Chrome and Firefox access services on the Intranet, Extended Protection for Authentication must be disabled on the ADFS sever.
As the ADFS server is ...
4
votes
2answers
522 views
Are some STS token formats better than others (SAML vs SWT vs JWT)
I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used.
The corresponding help link takes me to MSDN ...
1
vote
1answer
192 views
What risk can untrusted WS-Federation metadata pose?
I'm adding support for SAML/ADFS/Azure ACS and read that untrusted metadata poses a risk.
Considering that ADFS does background refreshes of the metadata, as do some RPs, can someone explain the ...
4
votes
1answer
353 views
How does the “Service Identity” feature of Azure ACS compare (and contrast) to a real IDP?
It appears that the ACS has IDP-style features within the "Service Identities" section. How does the ACS treat these in comparison to a real IDP? What is missing?
Some examples I'm thinking of ...
3
votes
2answers
839 views
How do Azure ACS 2.0 security features compare to ADFS 2.0?
I'm configuring my relying party (a website) to use either ADFS or Azure ACS 2.0.
ADFS 2.0 has some interesting features such as Token Replay prevention (in the SQL version) and may have other SAML ...
