Identity Integration Solutions

Active Directory Federated Services (ADFS) and Vintela Single Sign-on for Java

Vintela Single Sign-On for Java now includes support, which allows Tomcat or J2EE applications, to participate in the ADFS (Active Directory Federation Services) infrastructure. This extends the benefits of federation between partners deploying ADFS, by allowing an organization to present its Java-based applications to its trusted partners. The "account domain" partners can provide the authentication service, eliminating the need for to maintain account information for users accessing your systems from trusted partner organizations. Organizations that deploy Microsoft's federation technology can now include their Java-based applications in the same resource domain as their .NET applications.

The Vintela Single Sign-on for Java ADFS solution integrates seamlessly into the ADFS environment. Java-based applications are incorporated into the ADFS model simply by specifying the application URI of the Java application—exactly the same way.NET applications are managed from the ADFS MMC snap-in. ADFS provides the same claims-mapping services to the Java application as it does for .NET, so claims presented by account domain partners can be automatically mapped to their corresponding local resource domain claims.

The application itself can be configured to use the filtered SAML assertion as the basis for resolving role-based logic. Typically, well-formed Java applications require no code changes to leverage the SAML assertion presented to the J2EE application server in this way. It can of course also access the entire SAML token.

ADFS for Vintela Single Sign-on for Java extends the existing capabilities of the product, which allows intranet users to access J2EE applications without requiring additional authentication. Vintela Single Sign-on for Java uses the SPNEGO protocol supported by Internet Explorer to provide Integrated Windows Authentication for J2EE applications.

Applications may also be configured to use both methods of authentication and authorization simultaneously – external partners being authenticated using ADFS, internal users being authenticated by Kerberos and the SPNEGO protocol.