Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In ADFS, Is it possible to restrict set of OU’s user ids should not allow to authenticate?

E.g.: If we have 2 OU’s (let say OU1 & OU2) in the Active directory, if a user from OU1 tries to login from the ADFS login screen we should allow him to authenticate against AD, but if users from OU2 tries to login from the ADFS login screen we should not allow to authenticate and display an error message “Invalid User Id or Password”.

Thanks,

share|improve this question

migrated from stackoverflow.com May 15 '11 at 7:10

This question came from our site for professional and enthusiast programmers.

    
I'm guessing it should be possible to create an issuance authorization rule which matches the Active Directory distinguished name against 'OU=OU1' using a regular expression. –  Marnix Klooster Apr 9 '11 at 7:53
    
Thanks Marnix for your input, but Issuance authorizaton rules will come only after user is authenticated to ADFS, but I want to put a check before user authentication. –  krishna Apr 12 '11 at 16:44
    
If you have to use the rules: stackoverflow.com/q/15352332/9922 –  nzpcmad May 6 '13 at 19:24

1 Answer 1

To do this before the Issuance rules You'll probably have to modify the IdpInitiatedSignOn.aspx and write some custom code.

Guess you already know about Issuance Rules... But in case someone else doesn't mind Issuance coming after the authentication - or you haven't found a solution...

If you have Exchange or another way (I've done this with Powershell) of building Dynamic Groups based on OU http://technet.microsoft.com/en-us/library/bb123722.aspx you can put them in groups based on their OU. Note if you use Exchange you'll have issues if OU 1 or OU 2 is a child of one another...

You can then (In the relying party claims) create an "Issuance Authorization Rule" to Deny Access to a particular Group SID. You just punch in the group you want to deny, and after they try to authenticate (correct password or no) they get denied. (The message is not pretty.)

They'll get the standard looking "You've misconfigured something" ADFS message with the following info:

Access Denied

Server Name

There was a problem accessing the site. Try to browse to the site again. If the problem persists, contact the administrator of this site and provide the reference number to identify the problem. You are not authorized to access this site.

Contact your administrator for more information. Reference number: dddddd-71aa-26bb-dd34-e4569b8c04452

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.