Which service enables single sign-on across trusted domains?

Which service enables single sign-on across trusted domains?

• A. Active Directory Federation Services (AD FS)
• B. Active Directory Certificate Services (AD CS)
• C. Active Directory Lightweight Directory Services (AD LDS)
• D. Rights Management

Answer: (A)

Single sign-on across trusted domains is enabled by federation, where one trusted identity provider can authenticate a user for resources in other domains without re-prompts. Active Directory Federation Services acts as the token-based identity provider (the security token service) that issues claims tokens after a user signs in. These tokens are recognized by services in trusted domains, so once you’re authenticated in your home domain, you can access resources in partner or other domains seamlessly. AD FS supports standards like SAML and WS-Federation, which makes it interoperable with many apps and services, including cloud-based ones, across organization boundaries. The other options serve different roles: certificate services handle PKI for issuing certificates, lightweight directory services provide a directory without a full domain, and rights management focuses on protecting and controlling access to information rather than authenticating users across domains.

Single sign-on across trusted domains is enabled by federation, where one trusted identity provider can authenticate a user for resources in other domains without re-prompts. Active Directory Federation Services acts as the token-based identity provider (the security token service) that issues claims tokens after a user signs in. These tokens are recognized by services in trusted domains, so once you’re authenticated in your home domain, you can access resources in partner or other domains seamlessly. AD FS supports standards like SAML and WS-Federation, which makes it interoperable with many apps and services, including cloud-based ones, across organization boundaries.

The other options serve different roles: certificate services handle PKI for issuing certificates, lightweight directory services provide a directory without a full domain, and rights management focuses on protecting and controlling access to information rather than authenticating users across domains.