You should be able to script this or write an application to do it.
MessageOps makes a PowerShell module for Exchange Web Services (EWS).
You could also preview the REST APIs for Office 365 and use those in conjunction with Invoke-RestMethod
in PowerShell.
If you're looking for scripting specifics, I would definitely recommend posting on StackOverflow instead of here. If you end going that route, please send me a link to your question; it's interesting stuff.
For a non-Microsoft person, what is ADFS?
ADFS is Microsoft's solution for Single Sign On and web based authentication.
It is used primarily to provide a single set of credentials that can access a variety of sites not necessarily hosted within the same domain.
How does it differ to things like LDAP?
LDAP:
- Communicates using TCP/UDP on port 389 (or port 636 for LDAPS)
- Contains commands for searching/retrieving/adding/deleting/modifying users, profiles and other directory entries
- Can not be performed directly by a web browser, however HTTP authentication can be translated to LDAP using things like Apache's
mod_authnz_ldap
.
- When used for third-party website authentication, requires that username & password are provided to the third-party, which is not ideal for security.
- Is more of an open standard and has numerous Linux implementations.
ADFS:
- Better designed for the web as it communicates over standard HTTPS
- Follows a safer process similar (but not exact) to OAuth where the original username/password are provided directly to the organisation's ADFS server (or a proxy, but not the third-party), which if valid, returns a unique token that can be used to access a third-party website.
- Although it does use make use of some open standards (HTTPS, SAML etc.) it is Microsoft-specific and requires Internet Information Services (IIS) which only runs on Windows Servers.
See also this answer on the subject.
How does it work? What kind of information would be included in a typical request to an ADFS server? Is it designed for both authentication and authorization?
It works by having a single site (site A) that hosts the ADFS / ADFS proxy servers, which has access to the credentials (usually by communicating with an Active Directory Domain Controller). It is then given a trust between other sites (sites B & C) that require authenticating through the ADFS.
When a user attempts to access site B in their browser, the site redirects the user to the ADFS-proxy website (site A) which asks for their username & password, authenticates them, returns a set of cookies for remembering them, and redirects them back to the site B, along with an access token.
If the user then attempts to visit site C, they will also get redirected to site A for authentication from the ADFS-proxy website. If the right cookies exist, the user will not be required to enter their password again, but get instantly redirected back to site C with a token.
The ADFS can be configured with specific claims (or permissions) for the user, for authorization purposes. So it can serve both roles. (Note the difference between authentication and authorization.)
Some people prefer not to use it for authorization but instead keep the permissions management in the third-party website. The obvious downside is that both site A & B need to keep track of user accounts, while in the scenario where ADFS handles both, only the ADFS needs to be aware of the users.
Are ADFS servers typically accessible from the internet (whereas corporate AD domain controllers would not be)?
Yes, nearly always. ADFS is based on the notion that it will be primarily used for website authentication. And is built around IIS.
The ADFS-proxy site is the one that is usually accessible from the internet. However the ADFS itself is not. The ADFS is generally a separate server from the ADFS-proxy.
- ADFS Server
Server that links to the credentials, and has the claims configuration as well as the trusts. Generally not publicly accessible.
- ADFS Proxy Server
Server that hosts the IIS instance that has the login pages for the websites requiring authentication. Communicates back to the ADFS when requiring authentication. Generally publicly accessible.
Best Answer
You should gather some perfmon data to see if the server is under heavy load and whether load is distributed among the AD FS servers. Load balancers that are misconfigured (for example sticky sessions) can cause more traffic to one server than others in the farm.
Depending on the devices used to connect to Exchange Online, you may see more authentication traffic. Every time a connection is dropped and a new connection is established, Exchange may prompt the user for credentials. You may not see it if you clicked the save password option.At this point a logon will be done against AD FS using those credentials.
Incidentally the token lifetime for the O365 authentication platform is 1 hour by default. Not 8 hours. That 1 hour token is useful for passive applications (i.e. browser based) which use cookies for the session. They wont help in this case when new connections are constantly established by devices ( such as mail clients on phones/tablets).