Web Single Sign-on with WS-Federation

This blog post explains the role of WS-Federation in enterprise single sign-on, detailing the passive browser flow, token handling (claims, signatures, encryption), and how it integrates with ADFS and Entra ID in hybrid environments. It offers practical implementation guidance (endpoints, certificates, PowerShell configuration), operational pitfalls (redirects, firewall access), and security best practices (session management, single sign-off, MFA claims, certificate hygiene), and compares WS-Fed with SAML and OIDC to help choose the right protocol for different application stacks.