ADFS 2.0: send issuer of user certificate as claim

Question

Using ADFS 2.0, I would like to send to a relying party information about the issuer of the user certificate, if a user authenticated using an x509 certificate.

Is this possible? How should I configure the claim description and the claim rule?

Answer 1

AFAIK this is not possible as of writing this reply.

If you use the TLS client handler as per http://msdn.microsoft.com/en-us/library/ee895365.aspx you will be able to emit an http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod claim of http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/tlsclient if using a cert to logon to AD FS.

If instead you choose to use authentication mechanism assurance and users logon to their PC using a smartcard that's appropriately mapped to a group, your Kerberos TGT will have the group SID in the PAC. Therefore, even if the AD FS server was accessed using a Kerberos based token, it will be able to check for the said group SID in the token. This means you can emit a claim to assure a relevant smartcard logon occurred.

Please note the AD FS is not configured for TLSClient handler in the above scenario. If you access the AD FS remotely (not from corpnet and without Kerberos) through an AD FS proxy for example, you wouldn't be able to assert this authentication mechanism assurance. Therefore, you could have configuration where certain relying parties to be only accessible if authentication mechanism assurance is working as intended.