Search code examples
sharepointkerberosadfswapdmz

Using ADFS to provide Kerberos token for WAP and backend system

We have SharePoint on-prem using Kerberos and want to enable external users to connect to our system through WAP.

We like to avoid exposing our SharePoint "directly" to the outside network (pass-through) and not connect WAP in the DMZ with our internal AD domain (Kerberos delegation).

What are our remaining options?

Is ADFS capable of passing a Kerberos token? (it's on the internal network side)

Br, Tom

Solution

  • This is not possible. ADFS is only capable of doing Kerberos delegation (turning a saml token into a Kerberos token for the backend) if it's part of the domain.