Planning for External Access to AD FS

External access to the federation service is granted by means of a federation server proxy. A federation server proxy acts as an intermediary proxy service between client systems on the Internet and a federation service that is located behind a firewall on the corporate network. To enable Lync Online users to log on using SSO from outside the corporate network, a minimum of one AD FS proxy server is needed. However, if remote access to Lync Online is considered critical to the organization, then more than one proxy must be installed, and connections to the proxy systems would be load balanced using either a hardware load balancer or the Microsoft NLB feature.

The federation server proxy system (or cluster, if more than one system is used) must be accessible from the Internet using a public IP address. The DNS name assigned to the federation server proxy must also match the DNS name that is assigned to the internal federation server farm. The public server certificate that is applied to the internal federation server systems is also applied to each of the federation server proxy systems. Federation server proxy systems are typically installed in a DMZ subnet, and are configured as members of a workgroup to reduce the firewall port requirements between the federation proxies and the internal federation servers.

Figure 28.4 shows an example of a fully redundant AD FS topology that can be used to support SSO for Lync Online, using a pair of load-balanced federation proxies and a pair of load-balanced federation servers.

Figure 28.4. Example of redundant AD FS topology for Lync Online.