nerdexam
Microsoft

70-489 · Question #88

You are implementing a claims-based authentication solution for a SharePoint farm in an Active Directory Domain Services domain. You install and configure Active Directory Federation Services (AD…

The correct answer is A. Configure AD FS with the web application as a relying party. C. Configure web applications to use claims-based authentication and AD FS as the trusted E. Configure SharePoint to trust AD FS as an identity provider. Enabling SAML-based claims authentication in SharePoint with AD FS requires configuring trust relationships on both sides and setting web applications to use claims mode.

Design and develop advanced Microsoft SharePoint 2013 solutions

Question

You are implementing a claims-based authentication solution for a SharePoint farm in an Active Directory Domain Services domain. You install and configure Active Directory Federation Services (AD FS). You need to ensure that all web applications in the farm support SAML-based claims authentication. What should you do? (Each correct answer presents part of the solution. Choose all that apply.)

Options

  • AConfigure AD FS with the web application as a relying party.
  • BConfigure web applications to use forms-based authentication and AD FS as the trusted
  • CConfigure web applications to use claims-based authentication and AD FS as the trusted
  • DConfigure web applications to use classic mode authentication and AD FS as the trusted
  • EConfigure SharePoint to trust AD FS as an identity provider.

How the community answered

(41 responses)
  • A
    59% (24)
  • B
    17% (7)
  • D
    24% (10)

Why each option

Enabling SAML-based claims authentication in SharePoint with AD FS requires configuring trust relationships on both sides and setting web applications to use claims mode.

AConfigure AD FS with the web application as a relying party.Correct

AD FS must have each SharePoint web application registered as a relying party trust so it knows which applications are authorized to receive security tokens it issues.

BConfigure web applications to use forms-based authentication and AD FS as the trusted

Forms-based authentication uses ASP.NET membership providers and is not the correct mode for SAML token-based federation with AD FS; claims-based authentication mode is required instead.

CConfigure web applications to use claims-based authentication and AD FS as the trustedCorrect

Web applications must be configured for claims-based authentication mode (not classic or forms-only) and AD FS must be designated as the trusted identity provider so SharePoint can accept SAML tokens from it.

DConfigure web applications to use classic mode authentication and AD FS as the trusted

Classic mode authentication uses Windows NTLM or Kerberos and does not support claims or SAML tokens at all, making it incompatible with AD FS federation.

EConfigure SharePoint to trust AD FS as an identity provider.Correct

SharePoint must explicitly trust AD FS as an identity provider by importing its token-signing certificate and creating a SPTrustedIdentityTokenIssuer, establishing the trust from SharePoint's perspective.

Concept tested: SharePoint AD FS SAML claims-based authentication configuration

Source: https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/implement-saml-based-authentication-in-sharepoint-server

Topics

#claims-based authentication#AD FS#SAML#identity provider trust

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 70-489 Practice