Can ADFS store and return user profile info upon login?

Question

I am trying to connect my node.js application to ADFS, so that when a user logins in through ADFS it sends me the user's details (like whether he is an Admin, a regular user, or a privileged user). Can someone tell me if ADFS offers to store custom user details like that and send them back to my server when the user log's in so that I may know what level of access to grant the user?

Answer 1

When using an attribute store, the call is made in the context of the ADFS service account. The user doesn't need permission on the store.

The store could be a SQL database, an LDAP server, or a custom DLL. But if the information is stored on the user account in AD, you can simply extract and send it at token issuance using an issuance rule.

Answer 2

AD FS offers this functionality.
You can either:

• Send the group memberships in the claim
• Send a custom claimtype the app understands, based on a group membership