Hello

How does ADFS identify that a user is coming in via a external connection thus only offering certificate or forms based authentication ?

I have users that connect via a VPN which uses a shim and they share a external IP e.g 200.x.x.x. so they  are presented to ADFS as that IP 

Hi Frank,

Thanks for your post.

You could check the article for ADFS 3.0 External Authencation.

External authentication providers in AD FS in Windows Server 2012 R2: Overview

http://blogs.msdn.com/b/jenfieldmsft/archive/2014/03/24/adfs-external-authentication-provider-overview.aspx

And for more support, you post in the ADFS forum

https://social.msdn.microsoft.com/Forums/vstudio/en-US/home?forum=Geneva

Hope it is helpful to you.

Best Regards,

Mary Dong