nerdexam
Microsoft

70-332 · Question #3

You are implementing a claims-based authentication solution for a SharePoint farm in an Active Directory Domain Services domain. You install and configure Active Directory Federation Services (AD…

The correct answer is A. Configure AD FS with the web application as a relying party. C. Configure web applications to use claims-based authentication and AD FS as the trusted identity provider. E. Configure SharePoint to trust AD FS as an identity provider. Implementing SAML-based claims authentication with AD FS in SharePoint requires configuring AD FS to recognize SharePoint as a relying party, configuring web applications for claims-based authentication with AD FS as the trusted identity provider, and establishing trust between…

Configure and manage SharePoint environment

Question

You are implementing a claims-based authentication solution for a SharePoint farm in an Active Directory Domain Services domain. You install and configure Active Directory Federation Services (AD FS). You need to ensure that all web applications in the farm support SAML-based claims authentication. What should you do? (Each correct answer presents part of the solution. Choose all that apply.)

Options

  • AConfigure AD FS with the web application as a relying party.
  • BConfigure web applications to use forms-based authentication and AD FS as the trusted identity provider.
  • CConfigure web applications to use claims-based authentication and AD FS as the trusted identity provider.
  • DConfigure web applications to use classic mode authentication and AD FS as the trusted identity provider.
  • EConfigure SharePoint to trust AD FS as an identity provider.

How the community answered

(24 responses)
  • A
    79% (19)
  • B
    13% (3)
  • D
    8% (2)

Why each option

Implementing SAML-based claims authentication with AD FS in SharePoint requires configuring AD FS to recognize SharePoint as a relying party, configuring web applications for claims-based authentication with AD FS as the trusted identity provider, and establishing trust between SharePoint and AD FS.

AConfigure AD FS with the web application as a relying party.Correct

AD FS must have the SharePoint web application registered as a relying party trust so it knows to issue security tokens for that application.

BConfigure web applications to use forms-based authentication and AD FS as the trusted identity provider.

Forms-based authentication uses username and password forms and does not support SAML token exchange; SAML requires claims-based authentication mode, not FBA.

CConfigure web applications to use claims-based authentication and AD FS as the trusted identity provider.Correct

Each web application must be configured to use claims-based authentication mode and reference AD FS as the trusted identity provider, enabling it to accept SAML tokens.

DConfigure web applications to use classic mode authentication and AD FS as the trusted identity provider.

Classic mode authentication uses Kerberos or NTLM and is incompatible with SAML-based claims; it does not support trusted identity providers like AD FS.

EConfigure SharePoint to trust AD FS as an identity provider.Correct

SharePoint must explicitly trust AD FS as an identity provider by adding its token-signing certificate as a trusted root authority and creating a SPTrustedIdentityTokenIssuer, completing the trust chain.

Concept tested: SharePoint SAML claims authentication with AD FS configuration

Source: https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/implement-saml-based-authentication-in-sharepoint-server

Topics

#claims-based authentication#AD FS#SAML#trusted identity provider

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 70-332 Practice