SAML - Different claim values for same Entity ID

Question

Hello,

is it possible to have different claim values and Sign on URL for same Entity ID in Enterprise applications? I need to set up multiple Enterprise applications with same Entity ID, same claims IDs but different claims values and Sign on URL. I found this article but it looks like that claims values are generated only from Enterprise app. which has Entity ID without hash character, so it does not help too much.

Thank you for help,

Petr

Answer 1

Hello @PetrS ,

Thanks for reaching out.

Can you provide some examples that will assist me in better understanding your case and end goals? If I understand correctly, you wish to create multiple Enterprise applications with the same Entity ID in Azure AD but with different Sign on URLs.

Azure AD Identifier (Entity ID) value much be unique across all applications in your AAD tenant. In case of configuring more than one instance, then you could consider using any of below format which basically adding a string after actual identity by this way they become unique across in your Azure AD tenant.

Examples:

Azure AD also support adding a string after the GUID as Entity ID, something like this GUID_AppName , once successful authentication then you would see same value as audience in token claim as shown below:

Hope this helps.

-----
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hello Sikumars,

sorry for late answer.

Yes, almost. I would like to create multiple Enterprise applications with the same Entity ID in Azure AD, with different Sign on URLs and different claims (defined by specific claims mapping policy per Enterprise application).

So token for #1 app should looks like this:

And token for #2 app should looks like this:

Is it more clear now?

Thank you, I really appreciate your help,

Petr