AD FS 2.0 Claims Workflow with Issuers and Identity Providers

If you’re working with an AD FS farm with multiple claims providers, you may find it advantageous to generate “identifier” claims from those providers, so that in subsequent workflow in the claims pipeline, this can be used to build authorization logic around them and claims issued.

For example, let’s say we have Identity Providers FOO and BAR, using e-mail address as the inbound assertion/claim.

In the claims provider settings for each we’re going to validate the inbound request from the Foo IdP and the Bar IdP, based on the Issuer (Entity ID) and then insert a value into a claims description called  http://schemas.microsoft.com/2012/01/requestcontext/claims/x-idp

Foo Issuer / IdP

c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", Issuer == "https://foo.mydomain/com/idp"]
=> issue(Type = http://schemas.microsoft.com/2012/01/requestcontext/claims/x-idp, Value = "Foo IdP");

Bar Issuer / IdP

c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", Issuer == "https://bar.theirdomain/com/idp"]
=> issue(Type = http://schemas.microsoft.com/2012/01/requestcontext/claims/x-idp, Value = "Bar IdP");

If we then wish to insert further values  from an attribute store or  modify the claim later on , then this allows us to do so by calling upon the previously defined  http://schemas.microsoft.com/2012/01/requestcontext/claims/x-idp description, validating the value against our expected result and then issuing a new claim according to our requirements.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s