ADFS 2012 R2 – Office 365 Modern Auth – Outlook able to connect outside network

For a non-Microsoft person, what is ADFS?

ADFS is Microsoft's solution for Single Sign On and web based authentication.

It is used primarily to provide a single set of credentials that can access a variety of sites not necessarily hosted within the same domain.

How does it differ to things like LDAP?

LDAP:

• Communicates using TCP/UDP on port 389 (or port 636 for LDAPS)
• Contains commands for searching/retrieving/adding/deleting/modifying users, profiles and other directory entries
• Can not be performed directly by a web browser, however HTTP authentication can be translated to LDAP using things like Apache's mod_authnz_ldap.
• When used for third-party website authentication, requires that username & password are provided to the third-party, which is not ideal for security.
• Is more of an open standard and has numerous Linux implementations.

ADFS:

• Better designed for the web as it communicates over standard HTTPS
• Follows a safer process similar (but not exact) to OAuth where the original username/password are provided directly to the organisation's ADFS server (or a proxy, but not the third-party), which if valid, returns a unique token that can be used to access a third-party website.
• Although it does use make use of some open standards (HTTPS, SAML etc.) it is Microsoft-specific and requires Internet Information Services (IIS) which only runs on Windows Servers.

See also this answer on the subject.

How does it work? What kind of information would be included in a typical request to an ADFS server? Is it designed for both authentication and authorization?

It works by having a single site (site A) that hosts the ADFS / ADFS proxy servers, which has access to the credentials (usually by communicating with an Active Directory Domain Controller). It is then given a trust between other sites (sites B & C) that require authenticating through the ADFS.

When a user attempts to access site B in their browser, the site redirects the user to the ADFS-proxy website (site A) which asks for their username & password, authenticates them, returns a set of cookies for remembering them, and redirects them back to the site B, along with an access token.

If the user then attempts to visit site C, they will also get redirected to site A for authentication from the ADFS-proxy website. If the right cookies exist, the user will not be required to enter their password again, but get instantly redirected back to site C with a token.

The ADFS can be configured with specific claims (or permissions) for the user, for authorization purposes. So it can serve both roles. (Note the difference between authentication and authorization.)

Some people prefer not to use it for authorization but instead keep the permissions management in the third-party website. The obvious downside is that both site A & B need to keep track of user accounts, while in the scenario where ADFS handles both, only the ADFS needs to be aware of the users.

Are ADFS servers typically accessible from the internet (whereas corporate AD domain controllers would not be)?

Yes, nearly always. ADFS is based on the notion that it will be primarily used for website authentication. And is built around IIS.

The ADFS-proxy site is the one that is usually accessible from the internet. However the ADFS itself is not. The ADFS is generally a separate server from the ADFS-proxy.

• ADFS Server
  Server that links to the credentials, and has the claims configuration as well as the trusts. Generally not publicly accessible.
• ADFS Proxy Server
  Server that hosts the IIS instance that has the login pages for the websites requiring authentication. Communicates back to the ADFS when requiring authentication. Generally publicly accessible.

I solved this by tweaking the [AdfsConfiguration].[IdentityServerPolicy].[Policies] table in the ADFS configuration database. There's a record that covers the inbound claims. On my database it's ID '88EDF726-83FA-E511-80C5-000D3AB14473' though I don't know if they're constant values or vary by deployment. You can tell which one it is as it's quite long and has the cert eku claim in.

I modified it to include the following rule:

@RuleTemplate = "PassThroughClaims"
@RuleName = "Pass through certificate Subject claim"
c:[Type == "http://schemas.microsoft.com/2012/12/certificatecontext/field/subject", Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"]
 => issue(claim = c);