Claims that are not transferred to the relying party in ADFS 2.0

Question

Good, that's why I'm completely new to the world of self-confident applications. I was able to get up and work quickly using Azure ACS, but it was a slightly different story when I tried to use ADFS 2.0 as an identity provider (I want to actually use it as a federated provider, but for now I'm just trying to get a sample using it as a provider certificates).

I looked at the manuals here and tried to follow the AD FS 2.0 federation using the WIF application Step by Step, the Step by Step Guide Guide listed there. You will need to configure ADFS 2.0 along with a small sample application that you can use to view messages that are sent through.

That way, I can get this and run it through the formulas defined in the manual (only the Windows account name). The problem is that I'm trying to add more. I can access a third-party application in the ADFS GUI and add an emission transformation rule using an end-to-end or filtering inbound order rule template. However, when I launch my application, unless the added application type is a name, it will not transfer the application to my application.

One of the ones I wanted to go through was the email address for the user who logged into the application. So I added a rule to go through the email address, and then updated the sample application web.config file to uncomment this line in the ClaimTypeRequired section:

<claimType type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" optional="false" /> 

Please note that I install it as optional. I also updated the application federation metadata to add the following:

 <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" Optional="false" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706" /> 

Then I went into the ADFS GUI, went to gullible parties, and selected the update from the federation metadata in my sample application. Thus, he now lists the email as one of the accepted requirements.

Then I went into the Trusts Provider Claims and added the email claim rule to the Acceptance Transfer Rules for Active Directory Provider Trust (only one of them).

However, when I launch the application, it does not go through the application by email (or any others that I try). Can someone tell me what I'm missing here?

I should also note that I checked the test to change the application to accept the email rule, and not only did it not go through the email, but it still goes through the Windows account names and names, despite the fact that I I don’t even list them as accepted claims for my application.

If anyone could indicate where I will be dramatically mistaken here, that would be seriously appreciated.

After enabling logging according to the blog post before, here are the relevant journal entries: Event ID 1000 "Claims of the calling principal included in the details":

So you can see, the information I am requesting is clearly missing. I have a log output that contains detailed data, but in fact there is nothing interesting. You will see trace entries for the NETWORK SERVICE user (with the same set of requirements), but nothing surprising. All journal entries are informative, no errors.

Answer 1

If you use ADFS as an identity provider and want it to issue an application by email, you need to use the LDAP Attributes as claims or the User Application Rule , access to which AD as an attribute store and issues an email request. The pass is used for incoming requests if the user is already authenticated somewhere. In the case of Windows authentication, the Windows account name is issued from the Kerberos token and therefore you need to pass it, but others that you must specify.

Answer 2

Does the email address ask for an Active Directory address? I am not sure how to check this, but if it is not, it does not matter that you pass them. In this case, you need to try the rule "Send LDAP as Claims attributes"; based on what I see in my ADFS instance, try matching the "E-Mail-Addresses" attribute to the "Email address" requirement.

I had to do something like this to get UPN applications to come in, in circumstances like yours. I'm not sure if the LDAP attribute is potentially multiple if it matters.