AD FS 2.0 Claims Workflow with Issuers and Identity Providers

If you’re working with an AD FS farm with multiple claims providers, you may find it advantageous to generate “identifier” claims from those providers, so that in subsequent workflow in the claims pipeline, this can be used to build authorization logic around them and claims issued.

For example, let’s say we have Identity Providers FOO and BAR, using e-mail address as the inbound assertion/claim.

In the claims provider settings for each we’re going to validate the inbound request from the Foo IdP and the Bar IdP, based on the Issuer (Entity ID) and then insert a value into a claims description called

Foo Issuer / IdP

c:[Type == "", Issuer == "https://foo.mydomain/com/idp"]
=> issue(Type =, Value = "Foo IdP");

Bar Issuer / IdP

c:[Type == "", Issuer == "https://bar.theirdomain/com/idp"]
=> issue(Type =, Value = "Bar IdP");

If we then wish to insert further values  from an attribute store or  modify the claim later on , then this allows us to do so by calling upon the previously defined description, validating the value against our expected result and then issuing a new claim according to our requirements.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s