Tip: Webapplication set up for Claims Based Authentication

It is better to set up a default WebApplication that connects to your AD and then extend the Web Application for Claims based authentication. One of the key advantages of this is that what if your Secured Token Services breaks down due to any reason and your manager needs some documents ASAP. A site collection admin can go into SharePoint site using their AD credentials to get you appropriate documents.

Therefore, you should have 1 Web Application and 1 extension.