ADFS to Shibboleth

[Nancy Kerr]

That was the info were originally give.  The following is what I have for the claims rules.  The EmployeeID is not being passed to the Shibboleth system.

Nancy

Claim Rule #1

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
 => issue(store = "Active Directory", types = ("EmployeeNumber"), query = ";employeeID;{0}", param = c.Value);

Claim Rule #2

c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/employeeNumber"]
 => issue(Type = "urn:oid:2.16.840.1.113730.3.1.3", Value = c.Value, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/attributename"] = "urn:oasis:names:tc:SAML:2.0:attrnameformat:uri");




-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Thursday, June 28, 2018 3:23 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: ADFS to Shibboleth

> We are looking to sync\transfer EmployeeID from ADFS (on prem) to an 
> external Shibboleth system.

Then why are you attempting to encode it under the standard name for eduPersonPrincipalName? That's not a correct thing to do.

Were I to do this, I would use the name for employeeNumber, which happens to be urn:oid:2.16.840.1.113730.3.1.3

-- Scott

--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net