Claims rule to get WindowsAccountName

Question

I have configured Claims Provider Trust in ADFS and I am getting only Email in NameID. I can not make changes to Third party Claims Provider Trust, so I have to get WindowsAccountName using Email which I received in NameID from Third Party IDP and forward it to applications ahead.

Can someone please help me to write Claim Rules to support this?

(Context: Publishing OWA with ADFS)

Answer 1

Hi! According to this documentation you need to send the PrimarySID of the user as well as its UPN.

Assuming that a user exist in your forest with the UPN matching the NameID sent by the claim provider trust, you an just lookup the PrimarySID and the UPN. To look up the AD attribute store, you actually do not need the WindowsAccountName but just the domain name. Let's say the NetBIOS name of your domain is CONTOSO, then something of the sort would work.

Also, the suggested rules can be added at the end of the existing rules if you also have users from your own domain using it OWA. Else you can just remove the old rules and replace them with the following:

Rule 1: Take the NameID and make it the UPN

c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"]  
 => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn", Value = c.Value);  

Rule 2: Look for the PrimarySID with that UPN

c1:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"] && c2:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"]  
 => issue(store = "Active Directory", types = ("http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"), query = "(&(objectCategory=person)(objectClass=user)(|(userPrincipalName={0})(&(mail={0})(!(userPrincipalName={0})))));objectSid;CONTOSO\random", param = c2.Value);  

A couple of thing about this rule.

1. If the UPN is not found because it is not set, then we fall back looking for the mail attribute. I wrote it that way because it is possible to not have UPN in AD. When that's the case the UPN is "calculated" but the attribute is empty else the query just looking for the UPN would fail. The fall back to mail isn't great either because modify the mail attribute of a user might grant some access. If you don't want to use that fallback, here would be the rule: c1:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"] && c2:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"]
   => issue(store = "Active Directory", types = ("http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"), query = "(&(objectCategory=person)(objectClass=user)(userPrincipalName={0}));objectSid;CONTOSO\random", param = c2.Value);
   2. You need to replace CONTOSO by your domain. You don't need ro replace "random" this does not matter. And because of this, the rule will not work well in multi domain environment. If that's your case, let us know.