Understanding Organizational Group Claims

Article
02/22/2007

I created a list of topics last night that I think will be useful to put up here…Going in any kind of order will be too tough for me (lazy) and I’m afraid it would slow down my blog production. Please let me know if you would like to see something specific. Otherwise, I’ll just try to keep putting stuff up in random order.

If you aren’t familiar with Claims in ADFS – I’d suggest this short read on TechNet before going any further. As you will find with most of my blogs – it will be helpful to get Nick’s step-by-step up and running so you can follow along.

In this doc, I’ll go through the steps to create an Organizational Group Claim and map it from the Account Partner to the Resource Partner and then send it to an application.

While this information may not be useful/interesting for everyone, I find myself going through it with several people I talk to about ADFS. Most people have it down about 90% of the way – but aren’t super crisp on all the steps and why you take them. I’ll follow this up with a more in-depth blog which discusses all three claim types with some real world examples of how things should be setup. Custom claims and how you use them is just one item that could certainly use some further explanation. I didn’t understand claims 100% myself for a very long time (maybe I still don’t – but I think I can fake it now).

There isn’t a right or wrong way with the order in which you do this (other than the Organizational Claim must be created first on both sides), so I’ll just tell you my way.

The steps I take are as follows:

Start on the Account Partner

1. Create Organizational Group Claim on the Account Side

2. Right click the account store and do a new Group Claim Extraction

3. Right click the resource partner and do a new Outgoing Group Claim Mapping

Next – go to the Resource Partner

1. Create an Organizational Group Claim and associate it with a Windows Security Group on the resource group tab

2. Right click the account partner and choose New Incoming Group Claim Mapping

3. Highlight the application in which you want to receive this claim and choose enable

There are a couple things to help you remember this –

1. You need to visit/configure the claim in three places on each side

2. The above order is very similar to how the claim flows when a user access an app

A very common error I see is associating the claim with a Windows Group on the account side by using the resource group tab (like you do on the resource side). This is not correct – it won’t prevent it from working, but it is an unnecessary step. On the account side – the claim is associated to the Windows group via the group claim extraction (step 2) method. Since it’s the account side (no application) – we don’t need to associate the Group Claim to a Windows Group – we only need to extract the claim from the account store (another way to say this – we need to figure out which users get this claim)

Let’s go through everything from start to finish and hopefully it will become clear.

1. Create Organizational Group Claim on the Account Side