AD FS 部署拓撲注意事項AD FS Deployment Topology Considerations

適用於:Windows Server 2016、Windows Server 2012 R2、Windows Server 2012Applies To: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

本主題描述,協助您計畫並設計 production 環境中使用的 Active Directory 同盟服務 (AD FS) 部署拓撲重要的注意事項。This topic describes important considerations to help you plan and design which Active Directory Federation Services (AD FS) deployment topology to use in your production environment. 此主題是「檢視及評估考量影響哪些功能將會提供給 AD FS 部署之後的起點。This topic is a starting point for reviewing and assessing considerations that affect what features or capabilities will be available to you after you deploy AD FS. 例如根據的資料庫輸入您選擇儲存 AD FS 設定資料庫將最終來判斷您是否可以實作需要 SQL Server 特定安全性判斷提示標記語言 (SAML) 功能。For example, depending on which database type you choose to store the AD FS configuration database will ultimately determine whether you can implement certain Security Assertion Markup Language (SAML) features that require SQL Server.

判斷哪一種 AD FS 使用的設定資料庫Determining which type of AD FS configuration database to use

AD FS 使用儲存設定資料庫和 — 有時候 — 交易資料相關同盟服務。AD FS uses a database to store configuration and—in some cases—transactional data related to the Federation Service. 您可以使用 AD FS 軟體選取 built\ 中 Windows 內部資料庫 (WID) 或 Microsoft SQL Server 2005 或較新版本同盟服務中儲存資料。You can use the AD FS software to select either the built-in Windows Internal Database (WID) or Microsoft SQL Server 2005 or newer to store the data in the Federation Service.

大多數用途,資料庫兩種類型的相當等。For most purposes, the two database types are relatively equivalent. 但是,有一些開始朗讀詳細資訊,您可以使用 AD FS 使用的各種部署拓撲之前會注意到不同。However, there are some differences to be aware of before you begin reading more about the various deployment topologies that you can use with AD FS. 下表描述 WID 資料庫和 edition 是不同中支援的功能。The following table describes the differences in supported features between a WID database and a SQL Server database.

AD FS 功能AD FS features

功能Feature 支援 WID 嗎?Supported by WID? 支援 SQL Server 嗎?Supported by SQL Server? 此功能的相關詳細資訊More information about this feature
聯盟伺服器發電廠部署Federation server farm deployment 是,使用的每個農場五個聯盟伺服器限制Yes, with a limit of five federation servers for each farm [是]。Yes. 聯盟伺服器,您可以在單一發電廠部署的數目無執行限制There is no enforced limit for the number of federation servers that you can deploy in a single farm 判斷您 AD FS 部署拓撲Determine Your AD FS Deployment Topology
SAML 成品解析度請注意:此功能不需 Microsoft Online Services、Microsoft Office 365、Microsoft Exchange 或 Microsoft Office SharePoint 案例。SAML artifact resolution Note: This feature is not required for Microsoft Online Services, Microsoft Office 365, Microsoft Exchange, or Microsoft Office SharePoint scenarios. 否]No [是]Yes AD FS 設定資料庫的角色The Role of the AD FS Configuration Database

規劃安全和部署 AD FS 的最佳做法Best Practices for Secure Planning and Deployment of AD FS
聯盟-WS\ SAML\ 日權杖重播偵測SAML/WS-Federation token replay detection 否]No [是]Yes AD FS 設定資料庫的角色The Role of the AD FS Configuration Database

規劃安全和部署 AD FS 的最佳做法Best Practices for Secure Planning and Deployment of AD FS

資料庫功能Database features

功能Feature 支援 WID 嗎?Supported by WID? 支援 SQL Server 嗎?Supported by SQL Server? 此功能的相關詳細資訊More information about this feature
基本資料庫重複使用提取複寫,其中一或多個伺服器裝載 read\ 僅限來源的伺服器上的資料庫要求變更的複本,主控資料庫 read/寫入複本Basic database redundancy using pull replication, where one or more servers hosting a read-only copy of the database request changes that are made on a source server that hosts a read/write copy of the database [是]Yes 否]No AD FS 設定資料庫的角色The Role of the AD FS Configuration Database
使用 high\ 可用性方案,例如錯誤後的移轉叢集或鏡像資料庫冗餘 \(在資料庫層 only)請注意:所有 AD FS 部署拓撲都支援叢集 AD FS 服務層級。Database redundancy using high-availability solutions, such as failover clustering or mirroring (at the database layer only) Note: All AD FS deployment topologies support clustering at the AD FS service layer. 否]No [是]Yes AD FS 設定資料庫的角色The Role of the AD FS Configuration Database

可用性方案概觀High Availability Solutions Overview

SQL Server 注意事項SQL Server considerations

如果您 AD FS 部署選取設定資料庫 SQL Server,考慮下列部署實用資訊。You should consider the following deployment facts if you select SQL Server as the configuration database for your AD FS deployment.

  • SAML 功能,並其資料庫大小和成長SAML features and their effect on database size and growth. SAML 成品解析度或 SAML 權杖重播偵測功能的支援,AD FS 會所發行的每個 AD FS 標記 SQL Server 設定資料庫中儲存的資訊。When either the SAML artifact resolution or SAML token replay detection features are enabled, AD FS stores information in the SQL Server configuration database for each AD FS token that is issued. SQL Server 資料庫根據這項活動的成長並不會很大,並設定權杖重播保留期間而定。The growth of the SQL Server database as a result of this activity is not considered to be significant, and it depends on the configured token replay retention period. 每個成品記錄具有約 30 kb (KB) 的大小。Each artifact record has a size of approximately 30 kilobytes (KB).

  • 伺服器部署所需的數字Number of servers required for your deployment. 您將需要新增至少一個其他伺服器 \(若要將您 AD FS infrastructure\ 部署所需的伺服器總數)可做為專用主機 SQL Server 執行個體。You will need to add at least one additional server (to the total number of servers required to deploy your AD FS infrastructure) that will act as a dedicated host of the SQL Server instance. 如果您打算使用錯誤後的移轉叢集或鏡像提供 SQL Server 設定資料庫容錯和延展性的兩個 SQL server 至少需要。If you plan to use failover clustering or mirroring to provide fault tolerance and scalability for the SQL Server configuration database, a minimum of two SQL servers is required.

如何設定資料庫類型,您可能會影響硬體資源How the configuration database type you select may impact hardware resources

不很大的影響,而不聯盟伺服器部署陣列使用 SQL Server 資料庫中使用 WID 發電廠中部署聯盟伺服器上的硬體資源。The impact to hardware resources on a federation server that is deployed in a farm using WID as opposed to a federation server that is deployed in a farm using the SQL Server database is not significant. 不過,請務必現在,當您使用 WID 陣列時,在農地的每個聯盟伺服器必須市集、管理及維護複寫本機複本 AD FS 資料庫設定的變更時也會持續提供同盟服務需要正常運作。However, it is important to consider that when you use WID for the farm, each federation server in that farm must store, manage, and maintain replication changes for its local copy of the AD FS configuration database while also continuing to provide the normal operations that the Federation Service requires.

相較之下,使用 SQL Server 資料庫發電廠中部署聯盟伺服器不一定包含 AD FS 設定資料庫本機執行個體。In comparison, federation servers that are deployed in a farm that uses the SQL Server database do not necessarily contain a local instance of the AD FS configuration database. 因此,它們可以製作硬體資源稍微較少的要求。Therefore, they may make slightly fewer demands on hardware resources.

確認您的實際執行環境,可支援 AD FS 部署Verifying that your production environment can support an AD FS deployment

除了將部署聯盟伺服器和您現有的 production 環境設定方式而定,下列其他伺服器可能需要提供支援新 AD FS 部署所需的基礎結構:In addition to the federation servers that you will deploy, and depending on how your existing production environment is set up, the following additional servers may be required to provide the necessary infrastructure to support your new AD FS deployment:

  • Active Directory 網域控制站Active Directory domain controller

  • 憑證授權單位 (CA)Certification authority (CA)

  • 網頁伺服器主機聯盟中繼資料Web server to host federation metadata

  • 網路負載平衡 (NLB)Network load balancing (NLB)

也了See Also

Windows Server 2012 中的 AD FS 設計指南AD FS Design Guide in Windows Server 2012