0

I currently have an ADFS 2.0 environment which we use to provide SSO to a bunch of external SaaS applications (Cisco WebEx, Workday, Service Now and Cisco Jabber to name a few)

The business I work for has been acquired and the default email addresses of all users are being changed. This will be causing issues to most (if not all) Relying Party as they all use the E-mail-Addresses claim as UserName or ID.

I did a test with one of the dev SaaS apps we use and modified an existing claim on the RPT from "Pass through all claim values" to "Replace incoming e-mail suffix claims with a new e-mail suffix" and it worked as expected using a test account.

Is there a better way to handle this? I'd rather transform the E-mail Address attribute only once than doing it for every RPT (if it can be done!)

Thanks for all your help! Francis

Improve this question
2
  • 1
    Man, this is exactly the reason I hate so many applications treating email address as an immutable user ID. Some of them have it literally as the primary key in a database table. One of them even treated email addresses as case-sensitive such that a capitalization change in an email address was treated as an entirely new user.
    – Ryan Bolger
    Commented Jul 20, 2016 at 17:20
  • @RyanBolger Oh we have a provider that uses email addresses as being case sensitive (probably the same!) It's a pain to manage...
    – Francis Ouellet
    Commented Jul 20, 2016 at 17:52

1 Answer 1

Reset to default
0

I guess you get the email address of your users using a rule on your claim provider trust "Active Directory". What you could do is:

Create a new Claims Description, with this claim type for instance: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/wrongemailaddress

Replace your 2 rules:

AD CPT => get email from AD, put it in claim "emailaddress".
SaaS RPT => pass through claim "emailaddress".

With these 3:

AD CPT => get email from AD, put it in claim "WRONGemailaddress".
AD CPT => get claim "WRONGemailaddress",
          replace the email suffix,
          put the new value in a claim "emailaddress"
          (you can do all of this with a rule "Transform an Incoming Claim" I think)
SaaS RPT => pass through claim "emailaddress".

So your are only modifying the rules on one trust, your AD claim provider trust.

Improve this answer
1
  • Thanks @Matthieu, I was able to figure out quite a few things (how the ADFS claims pipeline works) from your example and a lot of trial and error. In a nutshell I added 2 rules on the CPT (one to add the email to the claim "bag") and a second transformation. Some of the RPs required changes as well as they mostly pick the email from AD directly.
    – Francis Ouellet
    Commented Aug 6, 2016 at 17:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .