Update SAML NameID Format using MS Graph

Question

I'm using Terraform to create a claims mapping policy, but I can't see a way to set the NameID value or format. There's nothing in the Microsoft or Terraform documentation which says how to change the NameID format or value using Microsoft Graph. Is this possible, and if so, how?

Thanks.

Answer 1

Hello @Daniel Milnes , in order to update a SAML enterprise application NameID attribute value and format using terraform and MS Graph you need:

1. Terraform AzureAD Provider to v1.5.0
2. Understand Claims Mapping Policies
3. Define an azuread_claims_mapping_policy resource to create the policy.
4. Define an azuread_service_principal_claims_mapping_policy_assignment to assign the policy to your application service principal.

Valid SamlNameIdFormats values are:

• urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
• urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
• urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
• urn:oasis:names:tc:SAML:2.0:nameid-format:transient

Sample:

   resource "azuread_claims_mapping_policy" "my_policy" {  
     definition = [  
       jsonencode(Valid  
         {  
           ClaimsMappingPolicy = {  
             ClaimsSchema = [  
               {  
                 ID            = "userprincipalname"  
                 SamlClaimType = "https://aws.amazon.com/SAML/Attributes/nameidentifier",  
                 SamlNameIdFormat = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",  
                 Source        = "user"  
               },  
             ]  
             IncludeBasicClaimSet = "true"  
             Version              = 1  
           }  
         }  
       ),  
     ]  
     display_name = "My Policy"  
   }  
     
   resource "azuread_service_principal_claims_mapping_policy_assignment" "app" {  
     claims_mapping_policy_id = azuread_claims_mapping_policy.my_policy.id  
     service_principal_id     = azuread_service_principal.my_principal.id  
   }  

Let us know if this answer was helpful to you or if you need additional assistance. If it was helpful, please remember to accept it so that others in the community with similar questions can more easily find a solution.

Answer 2

I've managed to figure this out, but it seems to be a really weird implementation detail on the backend. If you add an attribute to your claim mapping policy for http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier, it will realise what you mean and change the NameID format from urn:oasis:names:tc:SAML:2.0:nameid-format:persistent to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.

For anyone who finds this in the future, you can copy the following to get an email address in your NameID.

   resource "azuread_claims_mapping_policy" "this" {  
     definition = [  
       jsonencode(  
         {  
           ClaimsMappingPolicy = {  
             ClaimsSchema = [  
               {  
                 ID            = "userprincipalname"  
                 SamlClaimType = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"  
                 Source        = "user"  
               },  
             ]  
             IncludeBasicClaimSet = "true"  
             Version              = 1  
           }  
         }  
       ),  
     ]  
     display_name = "example"  
   }