ADFS - Claims Rule Language (SalesForce Chatter)

Question

Hello,

ADFS 2.0
Windows 2008 R2 Enterprise Edition

I have a need to append an email claim rule to end our current email suffix with ".chatter". The .chatter claim will be Idp-initiated as a value for a custom claim named "user.username" to the SP.

i.e ldap email value [e-mail] ---> [e-mail]

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
 => issue(store = "Active Directory", types = ("User.Email"), query = ";mail;{0}", param = c.Value + ".chatter");

I'm not getting the expected result, I know there is something wrong with the claims rule and it probably starts at my logic of adding a string to an already existing value. Does the rule need to be transformed? Any help is appreciated.

Thx,

Unique

Answer 1

I don't believe you can do that through the claims rule. What you could do is either create a custom provider to generate the claim, stick the value in a SQL database and pull from there, or create a new Active Directory attribute with the email address + .chatter. Your best option is probably to create the custom attribute.

---

Developer Security MVP | www.syfuhs.net

Answer 2

The QueryParam >c.Value + ".chatter"< will literally go into the LDAP query. Leave it at c.Value (being the windowsaccountname).

But use "add" (not issue) with a temporary name. Then match (in a new rule) temporary claim and "issue" final claim with your: c.Value + ".chatter".

---

Paul Lemmers

Answer 3

Thanks Paul!!

It worked perfect. I ended up using UPN instead of Email, since user's can have multiple SMTP addresses.

I took your suggestion:

1. Created a custom claim rule -- add query value of UPN to custom claim "User.UPN2"

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
 => add(store = "Active Directory", types = ("User.UPN2"), query = ";userPrincipalName;{0}", param = c.Value);

2. Create 2nd rule, issue value of "User.UPN2" + ".chatter"

c:[Type == "User.UPN2"]
 => issue(Type = "User.Username", Value = c.Value + ".chatter");

Thanks,

UG.

---

UG.