ADFS Claims Provider not receiving username/email

Question

ADFS Claims Provider not receiving username/email

Kushan Fernando 6

GDay,

I have an on-prem ADFS setup as below with SAML2,

SP <=> ADFS <=> IDP

When the SP initiates an authentication, the client can redirect to the IDP (configured as a Claims Provider) and authenticate himself.

However, I need to pass any form of client identification with the redirection from ADFS to IDP.

I can receive the NameID in ADFS (from SP => ADFS) but I cannot make the ADFS pass it beyond that to the IDP.

I've tried setting up a static claims rule on Claims Provider to see if I can pass 'something', but with no success.

=> issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Value = "******@company.com");

How do I get this working? I desperately need this for the SSO to work on my IDP side.

I'm ok with any sort of method/hacks/claim rule whatsoever.

Cheers.

1 answer

Your answer

Answer 1

Pierre Audonnet - MSFT 10,191 Microsoft Employee

You will need to following rules:

On your IDP, a rule that sends to AD FS the Username and the Email address
On AD FS:
- On the Claim Provider Trust for your IDP, you need to create a rule that passes through the Username and the Email address claims
- On the Relying Party Trust you need to create a rule that passes through the Username and the Email address claims

The exact rules will depend on what you have configured on your IDP. If you know what your IDP is sending, we can help you creating all the pass-through rules.

Kushan Fernando 6 Reputation points

2022-10-20T02:36:01.953+00:00

Thanks for your response @Pierre Audonnet - MSFT

I have those rules for receiving incoming claims and it works correctly. I receive an email from the IDP into ADFS -> ADFS Claims Provider Transform it -> Relaying Party Trust then pass it to SP. It works

However, as I described above, ADFS doesn't pass any user info from Claims Provider to IDP with the authentication request. My IDP maintains sessions, in order for it to use the session, it needs the username coming with the incoming authentication request.

I've also tried the /adfs/ls?username=<username> or /adfs/ls?login_hint=<username>
it just populates the email field inside the ADFS, but it doesn't pass it to the IDP.
Pierre Audonnet - MSFT 10,191 Reputation points Microsoft Employee

2022-10-20T12:38:34.1+00:00

Oh I see! It's not a claim you want to pass. Claims are not passed in that direction in your scenario. It's just a string to send to the IDP.

In what form are you entering the email address? Is the form at the SP level or at the AD FS level? Can you drive through what the user experience looks like?

Share via

ADFS Claims Provider not receiving username/email

1 answer

Your answer