Skip to main content
1 of 2

What I believe is the major difference is that with classic mode, you login directly, and if you need to be authenticated to a second server, it's not possible (you need to be logged in to this second server first -> new login screen). You will find that this is still often done but in that case the second connection is done under a different account (with privileges specifically for the resource, for instance).

With claims, you authenticate, you get a claims token and that is passed around to whoever needs it, and you are authenticated to this second server automatically without another login screen. Given that the server trusts your secure token service (whom initially authenticated you).

I may have the details wrong but in theory but this is generally how it works.

Source:

http://blogs.msdn.com/b/besidethepoint/archive/2010/05/09/double-hop-authentication-why-ntlm-fails-and-kerberos-works.aspx