In a business to business 81st century, the terminology that you use to describe the two partners in
their first deployment changes slightly.
In this scenario, another name for the claims provider organization is the account.
Partner and Account Partner Organization is an organization in which user accounts are stored in an
attribute store.
An account partner handles the following tasks.
It gathers credentials from users who are using a web based service and then authenticates those credentials.
And it also builds up claims for use.
Some of them package the claims into security tokens.
The tokens can be then presented across the Federation Trust to gain access to for duration resources
that are located in the Service Partners Organization to configure the account partner organization
to prepare for for duration, you have to use the following steps.
First, you have to implement the physical topology for the account partner deployment.
This step can include deciding on the number of duration server send for duration server proxies to
deploy and configure the required DNS records and certificates.
And the second step is to add an attribute store, use the error first management console to add the
attribute store.
In most cases, you use the default Active Directory Attributes Store, which can be used for authentication,
but you can also add other attributes stores if required to build the user claims.
You connect to a resource partner organization by creating a really important trust.
The simplest way to do this is to use the Federation method to your rule that is provided by the resource
partner organization.
With this option, your data for a server automatically collects the information required for the rule
line bar to trust.
The third step is to add a glamorous group.
So the claim description lists the claims that your organization provides to the resource partner.
This information might include usernames, email addresses, group membership information, or other
identifying information about users.
And finally, the fourth step is to prepare the client computers for for duration.
This might involve two steps.
You have to add the second part of the duration server in the browser.
So the client computers and the account partner for duration server to the local intranet side list
budget in the account partner federation server to the local intranet list all the client computers
you enable.
I w a which means that the users will not be prompted for authentication if they are already assigned
into the domain.
You can use group policy object to assign the URL to the local intranet site list.
And the second step is to configure certificate trusts.
This is an optional step that is required only if you if one or more of the servers of the client's
access do not have trusted certificates.
The client computer might have to connect to the configuration source resource for duration servers
or for the Russian server proxies and to the destination web servers.
If any of this certificates are not from the trusted public C, you might have to add the appropriate
certificate or root certificate to the certificate store of the client.
You can do this by using both as well.
Now some words about resource partner.
The resource partner is a real landlord in a business to business for duration.
Sonera The resource partner organization is where the resources exist and where they are made accessible
to the ground partner organizations.
The resource partner handles the following tasks it accepts security tokens, the Gold Partner Federation
server produces and validates, and it also consumes the claims from from the security tokens and then
provides new claims to its web servers after making an authorization decision.
Web servers must have either WITF or the ADA first.
One dot.
X claims were web agent installs to.
Externalize the identity, logic and accept claims.
WEF provides a set of development tools that allow developers to integrate claims based authentication
and authorization into their applications.
W If also includes a software deployment kit and sample applications.
Please know that you can use thermal tokens to integrate applications on non Microsoft web servers with
either of.
Additional open source or third party software.
As typical and necessary to support the use of thermal tokens on a known Microsoft Web server.
Though.
Some words about configuring a resource partner organization.
And it is similar to configuring in a go and partner organization and consist of the following steps.
First, you have to implement the physical topology for the resource partner deployment.
The planning and implementation steps are the same as those for the account partner with the additional
of blend of the web server, location and configuration.
The second step is to add an attribute to the claims provider using the attributes tool to gather data
that is necessary to issue the claims.
Data from the attribute store is then projected as claims to the client.
The third step is to connect to an account partner organization by creating a claims provider trust.
And finally, you have to create Glympse three sets.
For their claims for a wider trust.
Next up, we'll be talking about configuring claims rules.