3

Is there way to create a claim that will the return the DN of all groups and super-groups a user is a MemberOf?

Currently running Windows 2012 R2 ADFS.

Example:

I have a structure of groups like the following.

GrandparentGroup
ParentGroupA (memberOf=GrandparentGroup)
ParentGroupB (memberOf=GrandparentGroup)
GroupA (memberOf=ParentGroupA)
GroupB (memberOf=ParentGroupA)
GroupC (memberOf=ParentGroupB)
GroupD (memberOf=ParentGroupB)
UserA (memberOf=GroupA)
UserB (memberOf=GroupA, memberOf=GroupB)

I want to return the full-DNs of GroupA, ParentGroupA, and GrandparentGroup when UserA logs in.

If building a claim is not possible are there other was to handle this scenario with ADFS?

Improve this question
3
  • Its possible but your ADFS admin should veto this in a heartbeat and your security team should then pounce on thus. There is almost never a reason to send actual group membership.
    – Jim B
    Commented Mar 20, 2015 at 19:18
  • Thanks for the warning @jim-b . The use-case is a trusted internal application that makes use of group-membership for application-side content-authorization checks. The application will get the group membership somehow, but it greatly simplifies things if the membership can be returned in the authentication response from ADFS rather than requiring separate out-of-band queries directly at the AD.
    – Travis Stafford
    Commented Mar 20, 2015 at 20:35
  • You don't need ANY queries to AD, nor does an app need to know group membership. Have the ADFS rule issue a claim based on membership, eg if member of "appadmin"=> yesadmin. The app should be doing checks against claims not groups, trust has nothing to do with it. Enough RPs like this and you'll need a dedicated DC with monster ADFS farms.
    – Jim B
    Commented Mar 21, 2015 at 0:31

1 Answer 1

Reset to default
1

The answer to this question was answered on another forum.

The LDAP filter to list all groups (included nested groups) of a user is:

(member:1.2.840.113556.1.4.1941:=

So for example: (member:1.2.840.113556.1.4.1941:=CN=Alice,OU=Accounts,DC=contoso,DC=com)

Now how does it translate into a claim rule and ultimately a claim... First of all, I create 2 claim definitions. One called UserDN with the id http://contoso.com/myclaims/UserDN and MemberOfDN with the id http://contoso.com/myclaims/MemberOfDN. You guessed that the first one will receive the DN of the user and the second all the DN of al members the user is a member of.

Full write up can be found here: answer.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .