Lock Down Relying Party based on AD Attribute, Title

Question

Hi All,

We are using the ADFS 3.0. please help me.

As the title states, is it possible to lock down a relying party based on an attribute value a user has in AD?
For example, Our object is to Deny if the user's Title attribute value contains the word as "Contractor".

I have created below two rules in the Issuance Authorization Rule, but its not working.

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
=> add(store = "Active Directory", types = ("urn:oid:2.5.4.12"), query = ";title;{0}", param = c.Value);

EXISTS([Type == "http://contoso.com/title", Value == "Contractor"])
 => issue(Type = "http://schemas.microsoft.com/authorization/claims/permit", Value = "PermitUsersWithClaim");

Answer 1

You can make it work with the following three rules in the Issuance Authorization Rules:

Rule one allowing everyone:

 => issue(Type = "http://schemas.microsoft.com/authorization/claims/permit", Value = "true");

All rules are processed so it's not an issue to have this one. Then extract the title attribute:

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
 => add(store = "Active Directory", types = ("temp:/title"), query = ";title;{0}", param = c.Value);

Then you deny the contractors:

c:[Type == "temp:/title", Value == "Contractor"]
 => issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "DenyUsersWithClaim");