I am about to setup ADFS + claim-based and IDF for CRM2011, I have to do this for PowerMailChimp to work withour CRM. But I do not like to push my users to use claim-based aouthentication. We have no need for trusts between domains etc, it's a simple straight-forward single domain environment. Because I do not know of any side-effects with claim-based aouthenticatoin I like to keep the authenticatoin mode as it is, additionally provide claims-based for PowerMailChimp and eventually others who need it. Because I also want to keep ssl on 443 I decided to install ADFS 2.0 on a different server. I already managed to have ADFS/Claims-Based and IDF working in a test-envornment, but there was everything on the same server and only claims-based did work, no Active-Directory integrated in parallel.
The first thing which I don't feel confident with is that once I setup claim-based authentication no "normal" login is possible anymore (domain\uid) from that moment on. I wonder where the difference which url to be claim-based and which one to be not is made in the configuration. Does this just mean like domain.intra is considered to be internal and domain.com should be external = claim-based? But not even this is logical to me. I have to specify Web Address in CRM Deployment Manager and this is either/or - and from what I specifiy in my Web Addresses area in CRM Deploament Manager the claim-based url is created of. However, in my scenario once I turn on claim-based authentication on CRM no login is possible anymore (ADFS is not et configured correctly) no matter what url I use in order ot access my CRM server. I did this all only in a test environment so far, I am affraid to set this up on the live server as long I can't control which URL to be claim-based and which one not.
Also, I didn't really find yet realy helpfull docuemntaotin which describes how to setup adfs on one server and the rest on the CRM server. It is all about setting up everyting on the same server, sticking for 444 port for the CRM SSL etc.... In these docs everything is mixed up. any url works at any time since it's always the same. No idea when to use auth. or dev, or sts.....
But I read somewhere that all this stuff is meant to be setup both ways, claim-based for exterla users and keeping Ad-integrated for the internal uses. But no idea how to set this up.
Thanks
