Claims, custom Regex search replace if value is present in other claim

Question

Hi,

I have 2 incoming claims in my Claims provider trust flow.

Rule language in ADFS:

1, claim from external IDP

c:[Type == "masterid"]
=> issue(Type = "http://domain.com/claims/2017/06/masterid", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType);

2, the claim from external IDP are used to query onprem LDAP server

c:[Type == "http://domain.com/claims/2017/06/masterid"]
=> issue(store = "LDAP Server", types = ("http://domain.com/claims/2017/06/idremapping"), query = "name={0};idremapping;CONTOSO\gmsa-adfsfarm01$", param = c.Value);

So, the question and problem I would like to solve:

I want to send all the claim values in "1" as normal, but if it finds a value in rule "2" "http://domain.com/claims/2017/06/idremapping", then i would like to replace the value in "http://domain.com/claims/2017/06/masterid" from rule "1" with the value in rule "2" "http://domain.com/claims/2017/06/idremapping".

So I guess I need 2 or 3 rules to do this?

How do I do this? :)

Answer 1

@Pierre Audonnet - MSFT Do you have any idéa? :)

Answer 2

You could do something like this:

Rule 1
c:[Type == "masterid"]
=> issue(store = "LDAP Server", types = ("http://domain.com/claims/2017/06/idremapping"), query = "name={0};idremapping;CONTOSO\gmsa-adfsfarm01$", param = c.Value);

You issue http://domain.com/claims/2017/06/idremapping if you found it.

Rule 2
NOT EXISTS([Type == "http://domain.com/claims/2017/06/idremapping"])
=> add(Type = "temp:claim/LDAP", Value = "NoMatch);

If you didn't find it, then http://domain.com/claims/2017/06/idremapping will not be in the pipeline, so you add a temporary claim temp:claim/LDAP to the pipeline.

Rule 3
c1:[Type == "temp:claim/LDAP"] && c2:[Type == "masterid"]
=> issue(Type = "http://domain.com/claims/2017/06/idremapping", Value = c2.Value);

If you have the temp:claim/LDAP set and the masterid, then you issue http://domain.com/claims/2017/06/idremapping with the value of masterid. This is only process if temp:claim/LDAP is in the pipeline. You can also keep your first rule if you also need the http://domain.com/claims/2017/06/masterid in the token.