適用於:Windows Server 2016、Windows Server 2012 R2、Windows Server 2012Applies To: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

AD FS 設定資料庫的角色The Role of the AD FS Configuration Database

AD FS 設定資料庫儲存,表示 Active Directory 同盟服務 (AD FS) (that is, the Federation Service) 一個執行個體的所有設定資料。The AD FS configuration database stores all the configuration data that represents a single instance of Active Directory Federation Services (AD FS) (that is, the Federation Service). AD FS 設定資料庫定義參數同盟服務需要找出合作夥伴、憑證,屬性商店、宣告和有關這些相關聯的實體各種資料的集。The AD FS configuration database defines the set of parameters that a Federation Service requires to identify partners, certificates, attribute stores, claims, and various data about these associated entities. 您可以將此設定資料 Microsoft SQL Server® 資料庫或包含 Windows Server® 2008 年、Windows Server 2008 R2 和 Windows Server® 2012 年的 Windows 內部資料庫 (WID) 功能。You can store this configuration data in either a Microsoft SQL Server® database or the Windows Internal Database (WID) feature that is included with Windows Server® 2008, Windows Server 2008 R2 and Windows Server® 2012.

注意

AD FS 設定資料庫整個到可以是儲存在 WID 的執行個體或執行個體的 SQL 資料庫,但不是這兩個。The entire contents of the AD FS configuration database can be stored either in an instance of WID or in an instance of the SQL database, but not both. 這表示您無法使用使用 WID 與其他人使用 AD FS 設定資料庫同一個執行個體 SQL Server 資料庫某些聯盟伺服器。This means that you cannot have some federation servers using WID and others using a SQL Server database for the same instance of the AD FS configuration database.

您可以使用下列資訊,以及 content 中提供此主題中AD FS 部署拓撲考量以深入了解的優點和缺點選擇 [WID 或 SQL Server 儲存 AD FS 資料庫設定:You can use the following information in this topic along with the content provided in AD FS Deployment Topology Considerations to learn about the advantages and disadvantages of choosing either WID or SQL Server to store the AD FS configuration database:

WID 使用關聯的資料儲存並不具有其本身管理使用者介面 (UI)。WID uses a relational data store and does not have its own management user interface (UI). 而是系統管理員可以使用廣告 FS 管理 snap\ 中、Fsconfig.exe 或 Windows PowerShell™ cmdlet 修改廣告 FS 設定資料庫到。Instead, administrators can modify the contents of the AD FS configuration database by using either the AD FS Management snap-in, Fsconfig.exe, or Windows PowerShell™ cmdlets.

儲存設定資料庫 AD FS 使用 WIDUsing WID to store the AD FS configuration database

您可以建立 AD FS 設定資料庫使用在市集中為 WID 使用 Fsconfig.exe command\ 列工具或 AD FS 聯盟伺服器設定精靈。You can create the AD FS configuration database using WID as the store by using either the Fsconfig.exe command-line tool or the AD FS Federation Server Configuration Wizard. 當您使用這些工具時,您可以選擇下列其中一個選項來建立您的聯盟伺服器拓撲任何。When you use either of these tools, you can choose any of the following options to create your federation server topology. 每個選項來儲存 AD FS 設定資料庫中使用 WID:Each of these options uses WID for storing the AD FS configuration database:

  • 建立 stand\ 只聯盟伺服器Create a stand-alone federation server

  • 建立的第一個聯盟伺服器聯盟伺服器陣列Create the first federation server in a federation server farm

  • 新增至聯盟伺服器陣列聯盟伺服器Add a federation server to a federation server farm

如果您選擇 stand\ 只,WID 用來儲存 AD FS 設定資料庫一個執行個體。If you select the stand-alone option, WID is used to store a single instance of the AD FS configuration database. 無法分享焦跨多個聯盟伺服器。This instance cannot be shared across multiple federation servers. 它是適用於對短片測試 lab 環境。It is meant for test lab environments only. 如需有關 stand\ 只聯盟伺服器選項或一項設定的詳細資訊,請查看獨立聯盟伺服器使用 WID建立伺服器獨立聯盟For more information about the stand-alone federation server option or how to set one up, see Stand-Alone Federation Server Using WID or Create a Stand-Alone Federation Server.

如果您在聯盟伺服器發電廠選項中選取的第一個聯盟伺服器,WID 延展性,允許其他聯盟伺服器加入稍後發電廠設定。If you select the first federation server in a federation server farm option, WID is configured for scalability that will permit additional federation servers to be added to the farm at a later time. 如需部署 WID 發電廠或一項設定的相關資訊,請查看聯盟伺服器發電廠使用 WID建立第一個聯盟伺服器聯盟伺服器陣列For more information about deploying a WID farm or how to set one up, see Federation Server Farm Using WID or Create the First Federation Server in a Federation Server Farm

如果您選取新增聯盟伺服器] 選項,WID 已複製到新的聯盟伺服器的變更設定資料庫設定的時間間隔。If you select the add a federation server option, WID is configured to replicate configuration database changes to the new federation server at set intervals. 如需有關新增至 WID 陣列聯盟伺服器,查看聯盟伺服器發電廠使用 WID新增聯盟伺服器聯盟伺服器陣列到For more information about adding a federation server to a WID farm, see Federation Server Farm Using WID or Add a Federation Server to a Federation Server Farm.

注意

當您部署聯盟伺服器陣列使用 WID 時,AD FS 的部分功能可能無法使用。When you deploy a federation server farm using WID, some features of AD FS may not be available. 若要讓您設定您的伺服器陣列時設定的完整功能的存取,請考慮使用 Microsoft SQL Server 改為市集 AD FS 設定資料庫。To have access to the full feature set when you configure your server farm, consider using Microsoft SQL Server to store the AD FS configuration database instead. 如需詳細資訊,請查看AD FS 部署拓撲考量For more information, see AD FS Deployment Topology Considerations.

WID 聯盟伺服器陣列的運作方式How a WID federation server farm works

本節重要的概念描述 WID 聯盟伺服器發電廠之間伺服器聯盟主要和次要聯盟伺服器複寫資料的方式。This section describes important concepts that describe how the WID federation server farm replicates data between a primary federation server and secondary federation servers. ..

主要聯盟伺服器Primary federation server

電腦執行的是 Windows Server 2008、Windows Server 2008 R2 或 Windows Server® 2012 聯盟伺服器角色使用 AD FS 聯盟伺服器設定精靈中的設定,且具有 AD FS 設定資料庫讀取/寫入複本主要聯盟伺服器。A primary federation server is a computer running Windows Server 2008, Windows Server 2008 R2 or Windows Server® 2012 that has been configured in the federation server role with the AD FS Federation Server Configuration Wizard and that has a read/write copy of the AD FS configuration database. 當您使用 AD FS 聯盟伺服器設定精靈,並選取 [建立新的同盟服務,以及陣列中的第一個聯盟伺服器讓該電腦一律建立主要聯盟伺服器。The primary federation server is always created when you use the AD FS Federation Server Configuration Wizard and select the option to create a new Federation Service and make that computer the first federation server in the farm. 所有其他聯盟伺服器這個,也稱為「次要聯盟伺服器必須同步一份儲存在本機 AD FS 設定資料庫主要聯盟伺服器上所做的變更。All other federation servers in this farm, also known as secondary federation servers, must synchronize changes that are made on the primary federation server to a copy of the AD FS configuration database that is stored locally.

第二個聯盟伺服器Secondary federation servers

第二個聯盟伺服器會儲存一份 AD FS 設定資料庫從主要聯盟伺服器,但這些複本 read\ 僅限。Secondary federation servers store a copy of the AD FS configuration database from the primary federation server, but these copies are read-only. 連接到第二個聯盟伺服器,並輪詢它定期檢查是否已變更的資料與農場中的主要同盟伺服器同步處理資料。Secondary federation servers connect to and synchronize the data with the primary federation server in the farm by polling it at regular intervals to check whether data has changed. 次要同盟伺服器存在於提供主要聯盟伺服器容錯時 load\ 平衡存取要求其他網站整個網路環境中執行的。The secondary federation servers exist to provide fault tolerance for the primary federation server while acting to load-balance access requests that are made in different sites throughout your network environment.

注意

如果主要聯盟伺服器當機,離線所有第二個聯盟伺服器繼續處理要求正常。If a primary federation server crashes and is offline, all secondary federation servers continue to process requests as normal. 不過,不新可進行變更同盟服務直到主要聯盟伺服器帶回上網。However, no new changes can be made to the Federation Service until the primary federation server has been brought back online. 您也可以提名使用 Windows PowerShell 成為聯盟主要伺服器次要聯盟伺服器。You can also nominate a secondary federation server to become the primary federation server by using Windows PowerShell. 如需詳細資訊,請查看使用 Windows PowerShell AD FS 管理For more information, see the AD FS Administration with Windows PowerShell.

AD FS 設定資料庫進行同步處理How the AD FS configuration database is synchronized

AD FS 設定資料庫播放重要的角色,因為它可供網路中的所有聯盟伺服器上提供容錯和 load\ 平衡處理要求的功能 \(網路 load\ 平衡器時 used\)。Because of the important role that the AD FS configuration database plays, it is made available on all the federation servers in the network to provide fault tolerance and load-balancing capabilities when processing requests (when network load-balancers are used). 不過,可在此容量次要聯盟伺服器,必須同步 AD FS 設定資料庫儲存主要聯盟伺服器上。However, for secondary federation servers to serve in this capacity, the AD FS configuration database that is stored on the primary federation server must be synchronized.

當您新增發電廠聯盟伺服器時、新電腦,將會變成次要聯盟伺服器連接到主要聯盟伺服器複寫 AD FS 設定資料庫的複本。When you add a federation server to the farm, the new computer that will become a secondary federation server connects to the primary federation server to replicate the copy of the AD FS configuration database. 點之後,從新聯盟伺服器持續更新會從主要聯盟伺服器定期,如下所示。From this point forward, the new federation server continues to pull updates from the primary federation server on a regular basis, as shown in the following illustration.

AD FS 角色

每個次要聯盟伺服器輪詢主要聯盟伺服器變更為每個 5 分鐘。Each secondary federation server polls the primary federation server every five minutes for changes. 您可以調整此預設 five\ 分鐘值,或使用 Windows PowerShell cmdlet anytime 強制立即同步處理。You can adjust this default five-minute value or force an immediate synchronization anytime by using a Windows PowerShell cmdlet. 如需如何執行此動作,請查看使用 Windows PowerShell AD FS 管理For more information about how to do this, see AD FS Administration with Windows PowerShell.

在 WID 同步處理程序也支援更有效率傳輸中繼變更的增量傳輸。The WID synchronization process also supports incremental transfers for more efficient transfers of intermediate changes. 增量傳輸程序會需要少網路上的資料傳輸與傳輸速度完成。The incremental transfer process requires substantially less traffic on a network, and transfers are completed much faster.

注意

AD FS 設定資料庫從 WID SQL Server 的執行個體的移轉支援。The migration of an AD FS configuration database from WID to an instance of SQL Server is supported. 如需如何執行此動作,請查看AD FS:移轉 AD FS 設定資料庫 SQL Server 以TechNet Wiki 網站上。For more information about how to do this, see AD FS: Migrate Your AD FS Configuration Database to SQL Server on the TechNet Wiki site.

儲存設定資料庫 AD FS 使用 SQL ServerUsing SQL Server to store the AD FS configuration database

您可以建立 AD FS 設定資料庫使用在市集中為單一 SQL Server 資料庫執行個體使用 Fsconfig.exe command\ 列工具。You can create the AD FS configuration database using a single SQL Server database instance as the store by using the Fsconfig.exe command-line tool. 使用 AD FS 設定資料庫 SQL Server 資料庫透過 WID 提供下列優點:Using a SQL Server database as the AD FS configuration database provides the following benefits over WID:

  • 系統管理員可以利用 SQL Server 的可用性功能Administrators can leverage the high availability features of SQL Server

  • 高流量提供額外的效能增加。It provides additional performance increases for high traffic.

  • 提供的 SAML 成品解析度及 SAML 日 WS-聯盟權杖重播偵測 (described below) 功能的支援。It provides feature support of SAML artifact resolution and SAML/WS-Federation token replay detection (described below).

字詞「主要聯盟伺服器」不適用於 AD FS 設定資料庫儲存在資料庫執行個體 SQL 因為所有聯盟伺服器同樣讀取和寫入 AD FS 設定資料庫使用相同叢集的 SQL Server 的執行個體,如下所示。The term “primary federation server” does not apply when the AD FS configuration database is stored in a SQL database instance because all federation servers can equally read and write to the AD FS configuration database that is using the same clustered SQL Server instance, as shown in the following illustration.

AD FS 角色

您可以使用 SQL Server 設定兩個或更多一同合作,以確保 AD FS 進行傳入 client 要求服務的可用性伺服器叢集伺服器。You can use SQL Server to configure two or more servers to work together as a server cluster to ensure that AD FS is made highly available to service incoming client requests. 可用性提供中,您可以透過新增額外的伺服器增加伺服器容量 scale\ 出架構。High availability provides a scale-out architecture in which you can increase server capacity by adding additional servers. 自動叢集容錯移轉的減輕單點失敗。Single points of failure are mitigated by automatic cluster failover.

您可以使用的網路 load\ 平衡和 SQL 叢集技術提供容錯移轉服務達成可用性。You can achieve high availability by using the network load-balancing and failover services that SQL clustering technologies provide. 如需了解如何設定可用性 SQL Server 的詳細資訊,請查看高可用性方案概觀For more information about how to configure SQL Server for high availability, see High Availability Solutions Overview.

SAML 成品解析度SAML artifact resolution

安全性判斷提示標記語言 (SAML) 成品解析度為基礎 SAML 2.0 通訊協定告訴您如何信賴可以直接從宣告提供者擷取預付碼的一部分,並且端點。Security Assertion Markup Language (SAML) artifact resolution is an endpoint based on the part of the SAML 2.0 protocol that describes how a relying party can retrieve a token directly from a claims provider. 在第一階段中的解析度程序,瀏覽器 client 連絡人資源聯盟伺服器,並提供成品。In the first stage of the resolution process, a browser client contacts a resource federation server and provides it with an artifact. 在第二個階段中,資源聯盟伺服器傳送成品解析成品郵件帳號合作夥伴組織中地方裝載 SAML 成品端點 url。In the second stage, resource federation servers send the artifact to a SAML artifact endpoint URL that is hosted somewhere in an account partner organization in order to resolve the artifact message. 中的最後階段,account 聯盟伺服器會發出權杖代表瀏覽器 client 聯盟伺服器。In the final stage, the account federation server issues the token to the federation server on behalf of the browser client.

注意

如果您是 account 合作夥伴公司的系統管理員,請務必指派,或是 SSL 憑證鏈結根憑證的 Windows 根憑證計畫的成員,繫結至在聯盟被動式網站 \ (\Sites\Default WebSite\adfs\ls) 發電廠中的所有 account 聯盟伺服器上。If you are an administrator in an account partner organization, make sure to assign or bind an SSL certificate, which chains to a root certificate of a member of the Windows Root Certificate Program, to the federation passive Web site in IIS (\Sites\Default Web Site\adfs\ls) on all the account federation servers in the farm. 這是重要防止手動新增到本機電腦受信任的人憑證存放區 SSL 憑證有或無法解析在組織中發行成品資源聯盟伺服器。This is important to prevent resource federation servers from having to manually add the SSL certificate to the Local Computers Trusted People certificate store or from being unable to resolve the artifact that is published in your organization.

SAML 日 WS-聯盟權杖重播偵測SAML/WS - Federation token replay detection

字詞權杖執行指的是,讓瀏覽器 client account 合作夥伴組織中的嘗試資源聯盟伺服器傳送驗證相同權杖它收到 account 聯盟伺服器多次動作。The term token replay refers to the act by which a browser client in an account partner organization attempts to send the same token it received from an account federation server multiple times to authenticate to a resource federation server. 這個動作會發生當使用者按下為了重新提交驗證網頁瀏覽器的按鈕。This act occurs when a user clicks the Back button of their browser in an effort to resubmit the authentication page.

AD FS 提供的功能稱為權杖偵測執行的多個權杖要求所使用的相同權杖偵測到,然後捨棄。AD FS provides a feature referred to as token replay detection by which multiple token requests using the same token can be detected and then discarded. 這項功能,當權杖重播偵測會用來保護驗證要求 WS-聯盟被動式設定檔和 SAML WebSSO 基本資料的完整性確定相同權杖一律不會超過一次。When this feature is enabled, token replay detection protects the integrity of authentication requests in both the WS-Federation passive profile and the SAML WebSSO profile by making sure that the same token is never used more than once. 這項功能應該會在安全性時非常高考量例如支援使用 kiosk。This feature should be enabled in situations where security is a very high concern such as when using kiosks.

在 kiosk 範例中,使用者可以使用所有網站登入,稍後惡意的使用者可以嘗試使用的瀏覽器歷史以重新提交的使用者先前已載入驗證聯盟的頁面。In the kiosk example, a user can log off of all Web sites and later a malicious user can attempt to use the browser history in order to resubmit the federated authentication page that was loaded by the previous user. 這項功能來儲存其他資訊,有關偵測後續重播的預付碼和防止後續多個驗證嘗試以 account 合作夥伴公司所做的每個成功驗證降低此問題。This feature mitigates this concern by storing additional information about each successful authentication made by an account partner organization in order to detect subsequent replays of the token and prevent multiple authentication attempts from succeeding.