ADFS Email address in Name ID

Question

Hey all.

I have been spinning my wheels on this one when trying to get ADFS to integrate with a OKTA setup.

our ADFS server is running 2016, so I believe its v 2.

when I try to use Email Address or AD FS 1x E-Mail Address, the NAME ID is not shown the SAML. If i use something like IP address or inside network, I see NAME ID.

However, I can do an Attribute store pull from AD with the Email address of the user without issue.

Answer 1

AD FS on Windows Server 2016 is commonly refered to as ADFS v4.

If you need to do is send the actual user's email address as a Name ID of Email type to a relying party, you can use the following mapping:

1. Extract the email address of the user as map it as the E-Mail Address claim with rule wizard Send LDAP Attributes as Claims:
   
2. Then you can map the Name ID with a Transform an Incoming claim rule:
   
   You can also pick another format there according to your application's requirements.

(the rules need to be in this order)

Of course, that will work only if the user actually has a mail attribute. If you want to send the userPrincipalName (UPN) as a Email Name ID type too.