ADFS RP to Azure AD RP Migration

Question

ADFS RP to Azure AD RP Migration

DT_Support 21

Hello,

We are in the process of moving our Relay Parties trusts from on prem ADFS to Azure AD. I have a party trust setup with WebEx and it inlcudes some custom claim rules. Can someone help me in the proper formatting of these claims in Azure AD SSO?

=> issue(Type = "optionalparams", Value = "MW=Pro");
=> issue(Type = "optionalparams", Value = "FL=OFF");
=> issue(Type = "optionalparams", Value = "RC=OFF");
=> issue(Type = "optionalparams", Value = "RE=OFF");
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
=> issue(store = "Active Directory", types = ("updateTimeStamp"), query = ";whenChanged;{0}", param = c.Value);

I am not sure if any of these are supported in Azure AD SSO. If so assitance in the proper formatting and setup would be greatly appreciated.

Thank You

Pierre Audonnet - MSFT 10,091 Reputation points Microsoft Employee

2020-04-12T15:14:42.117+00:00

Note that your rule number 5 is a tad problematic. The attribute whenChanged is not replicated. So it will have a different value depending on which DC ADFS has used for the LDAP query. Also, if you promote a new DC, all whenChanged attribute will show the date of promotion of the DC you query instead of the "real" time at which the object was modified. There are ways to query the exact time, and even the exact attribute which was last touched but we cannot do it built-in with ADFS (you would need to create a custom attribute store).

Pierre Audonnet - MSFT 10,091 Reputation points Microsoft Employee

2020-04-12T15:14:42.117+00:00

Note that your rule number 5 is a tad problematic. The attribute whenChanged is not replicated. So it will have a different value depending on which DC ADFS has used for the LDAP query. Also, if you promote a new DC, all whenChanged attribute will show the date of promotion of the DC you query instead of the "real" time at which the object was modified. There are ways to query the exact time, and even the exact attribute which was last touched but we cannot do it built-in with ADFS (you would need to create a custom attribute store).

Answer 1

Ĵerome L 196

Have you checked your app activity page for compatibility? https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/migrate-adfs-application-activity
Check this page too for mapping each field: https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/migrate-adfs-apps-to-azure

Answer 2

Ĵerome L 196

But you would add them under custom attribute.

Answer 3

DT_Support 21

Hi JLight,

Thank you for the response. App compatibility shows everything is green and ready to move.

I think the custom attributes is what I was looking for and if their would be any special formatting, but from your example, looks pretty straight forward.

Answer 4

DT_Support 21

I have another question surrounding the "optionalparams" as the name.

When adding that claim its only allowing a single "optionalparams" name. I cannot add another claim name "optionalparams"

Based on the values, would use the MW as the name and the value as Pro

ADFS RP to Azure AD RP Migration

4 answers

Activity