0

I have ADFS 3.0 set up and any user in the domain can login to my site (authentication was done previously with LDAP). I set up some claim rules so that I can get the user's name, email address, and the groups the member is in. When I was using LDAP I was able to get all of this information. I am using a SAML Chrome Panel to view the SAML Responses. None of the information that I set up in the claim rules are showing up in the response. Here is an example response(some of the data has been changed for security):

<samlp:Response Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
    Destination="https://ssotest.trknow.local:8443/sammy/saml/SSO"
    ID="_alphanumeric" IssueInstant="2019-03-29T13:52:09.586Z" Version="2.0"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://federation.trknow.com/adfs/services/trust</Issuer>
    <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
    <EncryptedAssertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
        <xenc:EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element"
            xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
            <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
                <e:EncryptedKey xmlns:e="http://www.w3.org/2001/04/xmlenc#">
                    <e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/></e:EncryptionMethod>
                    <KeyInfo>
                        <ds:X509Data xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                            <ds:X509IssuerSerial>
                                <ds:X509IssuerName>CN=trknow-VERIFY-CA, DC=trknow, DC=local</ds:X509IssuerName>
                                <ds:X509SerialNumber>serial_number</ds:X509SerialNumber>
                            </ds:X509IssuerSerial>
                        </ds:X509Data>
                    </KeyInfo>
                    <e:CipherData>
                        <e:CipherValue>ciphervalidi/A==</e:CipherValue>
                    </e:CipherData>
                </e:EncryptedKey>
            </KeyInfo>
            <xenc:CipherData>
                <xenc:CipherValue>*truncated*sva2kFMnlfrnfF4Zxd2XRCg6UW4cjrEqpjlR1oaqZrc3EwTAaaHh9Ta7U7T27Q8iPNBq9VRjjW5RcE8mrRCCGThXpeAcEkF5cw9BZ+JCz2QVEpb4Ul6iJVybe1lwA9uaEBimebH+c1hBM9vo3SOAQ=</xenc:CipherValue>
            </xenc:CipherData>
        </xenc:EncryptedData>
    </EncryptedAssertion>
</samlp:Response>

You can see no details provided. Now here are my claim rules: First a snapshot and then the rule language underneath: Click for Picture of Claims: overview
1) Email2Email

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
 => issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"), query = ";mail;{0}", param = c.Value);

2) Email2NameID

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
 => issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"), query = ";mail;{0}", param = c.Value);

3) Full Name

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
 => issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"), query = ";sn,givenName;{0}", param = c.Value);

4) memberOfGroup

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
 => issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/claims/Group"), query = ";memberOf;{0}", param = c.Value);

5) Group SID

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid"]
 => issue(claim = c);

Here is my LDAP search and filter criteria. Trying to mirror this with ADFS claim rules:

managerDn = 'CN=Site LDAP Service Account,CN=Managed Service Accounts,DC=trk,DC=trknow,DC=com'
managerPassword = 'password'
server = 'ldap://tstrodc01.trk.trknow.com:389'
groupSearchBase = 'ou=Stations,dc=trk,dc=trknow,dc=com'
search.base = 'dc=trk,dc=trknow,dc=com'
search.filter= '(sAMAccountName={0})'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.