<html>
<head>
<meta name="generator" content="Windows Mail 17.5.9600.20315">
<style><!--
.EmailQuote {
margin-left:1pt;
padding-left:4pt;
border-left:#800000 2px solid;
}
--></style><style data-externalstyle="true"><!--
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
}
p.MsoNormal, li.MsoNormal, div.MsoNormal {
margin:0in;
margin-bottom:.0001pt;
}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst,
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle,
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
line-height:115%;
}
--></style></head>
<body dir="ltr">
<div data-externalstyle="false" dir="ltr" style="font-family: 'Calibri', 'Segoe UI', 'Meiryo', 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'sans-serif';font-size:12pt;">
<div>One way to accomplish your goal is to use the ADFS Claim Rule wizard to create an LDAP rule that maps Employee-ID to urn:oid:2.16.840.1.113730.3.1.3.</div><div><br>The resulting syntax is:</div><div><br></div><div>c:[Type == "<a href="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" target="_parent">http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname</a>", Issuer == "AD AUTHORITY"]<br> => issue(store = "Active Directory", types = ("urn:oid:2.16.840.1.113730.3.1.3"), query = ";employeeID;{0}", param = c.Value);<br></div><div><br></div><div>This takes the windowsaccountname and passes it to the LDAP search as the c.Value in the query. The LDAP search retrieves the AD employeeID attribute value and creates a SAML attribute of urn:oid:2.16.840.1.113730.3.1.3.</div><div><br></div><div>If you wanted to retrieve the AD employeeNumber instead of employeeID you’d have to change the parameter in the query.</div><div><br></div><div>You can do this on in the Claims Rules for the relying party or you can do it on the AD Claims Provider Trust. If you do it on the claims provider trust you have to add a rule on the relying party side to pass the value.</div><div><br></div><div>If performance matters it is best to do all the LDAP retrievals in one rule on the claims provider trust.</div><div><br>Randy</div><div><br></div><div><br></div><div data-signatureblock="true"><br></div><div style="padding-top: 5px; border-top-color: rgb(229, 229, 229); border-top-width: 1px; border-top-style: solid;"><div><font face=" 'Calibri', 'Segoe UI', 'Meiryo', 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'sans-serif'" style='line-height: 15pt; letter-spacing: 0.02em; font-family: "Calibri", "Segoe UI", "Meiryo", "Microsoft YaHei UI", "Microsoft JhengHei UI", "Malgun Gothic", "sans-serif"; font-size: 12pt;'><b>From:</b> <a href="mailto:cantor.2@osu.edu" target="_parent">Cantor, Scott</a><br><b>Sent:</b> Thursday, January 2, 2014 6:15 PM<br><b>To:</b> <a href="mailto:users@shibboleth.net" target="_parent">Shib Users</a></font></div></div><div><br></div><div dir="">
<div class="PlainText">On 1/2/14, 6:13 PM, "Mercer, Keith" <keith.mercer@ndus.edu> wrote:<br>
<br>
>So that attribute is supposed to both point at employeeNumber and<br>
>employeeID?<br>
<br>
Your local attribute names aren't important, it doesn't "point" at<br>
anything. The OID URN you posted is the SAML standard's name for the LDAP<br>
attribute coloquially referred to as employeeNumber.<br>
<br>
<a href="http://www.faqs.org/rfcs/rfc2798.html" target="_parent">http://www.faqs.org/rfcs/rfc2798.html</a><br>
<br>
It doesn't matter what it starts out as. In my case, it's a column in a<br>
database.<br>
<br>
> Does that mean the query = just needs to be altered?<br>
<br>
That would be an ADFS question, but from what little I know of their<br>
undocumented scripting language, I would assume so.<br>
<br>
-- Scott<br>
<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</div>
</div>
</body>
</html>