Re: ADFS to Shibboleth

[Randy Wiemer]

One way to accomplish your goal is to use the ADFS Claim Rule wizard to create an LDAP rule that maps Employee-ID to urn:oid:2.16.840.1.113730.3.1.3.


The resulting syntax is:


c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
 => issue(store = "Active Directory", types = ("urn:oid:2.16.840.1.113730.3.1.3"), query = ";employeeID;{0}", param = c.Value);





This takes the windowsaccountname and passes it to the LDAP search as the c.Value in the query.  The LDAP search retrieves the AD employeeID attribute value and creates a SAML attribute of urn:oid:2.16.840.1.113730.3.1.3.


If you wanted to retrieve the AD employeeNumber instead of employeeID you’d have to change the parameter in the query.


You can do this on in the Claims Rules for the relying party or you can do it on the AD Claims Provider Trust.  If you do it on the claims provider trust you have to add a rule on the relying party side to pass the value.


If performance matters it is best to do all the LDAP retrievals in one rule on the claims provider trust.


Randy









From: Cantor, Scott
Sent: ‎Thursday‎, ‎January‎ ‎2‎, ‎2014 ‎6‎:‎15‎ ‎PM
To: Shib Users





On 1/2/14, 6:13 PM, "Mercer, Keith" <keith.mercer at ndus.edu> wrote:

>So that attribute is supposed to both point at employeeNumber and
>employeeID?

Your local attribute names aren't important, it doesn't "point" at
anything. The OID URN you posted is the SAML standard's name for the LDAP
attribute coloquially referred to as employeeNumber.

http://www.faqs.org/rfcs/rfc2798.html

It doesn't matter what it starts out as. In my case, it's a column in a
database.

>  Does that mean the query = just needs to be altered?

That would be an ADFS question, but from what little I know of their
undocumented scripting language, I would assume so.

-- Scott



--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140103/118ef80c/attachment.html