Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to send objectGUID as a claim with AD FS 2.0 running on Windows Server 2012.

I know I can create Issuance Transform Rules for a Relying Party Trust, but how does AD FS 2.0 know about objectGUID? Do I need to add a claim description for objectGUID under AD FS\Service\Claim Descriptions?

share|improve this question
up vote 2 down vote accepted

The objectGuid LDAP attribute can be sent as the value of any claim by using "Send LDAP Attributes as Claims Rule" and specifying objectGuid as the source attribute. ADFS has no specific knowledge of LDAP attributes, and if you were to extend your LDAP schema, you could use those just as easily as any other. The particular claim you must transform it to is mandated by the relying party.

If you are just using it as the user's unique ID, you might send it as (Private Personal Identifier), but you might also send it in a claim specific to your particular RP (which is when you would need to add a claim description).

share|improve this answer
Thanks! This worked great. – whargrove Jan 24 '14 at 3:04

Refer ADFS : objectGUID as a claim.

The problem isn't so much accessing it but the fact that it "converts" it to something that doesn't match the original entry in AD.

share|improve this answer
you're blog post was helpful in discovering the base64 behavior with AD FS. I'm not so concerned that the value sent as the AD FS claim is not the actual value. My main concern is that I am able to extract a unique/immutable value for each user. – whargrove Jan 24 '14 at 3:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.