ADFS 2012R2 Claims that map from LDAP to SAML2 output not always clear

Mike Murphy 41 Reputation points
2020-06-26T23:15:41.013+00:00

I'm trying to create a claim issuance policy. One of the mappings has to be the user SID. When I use the Get-ADUser powershell cmdlet I can see the User SID property is "SID", but when I try to find that in the list of pre-defined LDAP menu items, there is nothing there like that. no objectSID either. Can I just type that in, and if so will it work?

10834-adfs.png

Thanks

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,203 questions
Accepted answer
  1. Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee
    2020-06-27T16:14:48.373+00:00

    When an attribute is not in the wizard, you can just type its actual LDAP display name. For the SID it is "objectSid".

    But there is an easier way in this case. The user's SID is already in the claim pipeline (it is coming from the AD acceptance rules). SO instead of doing a LDAP call, you can simply chose the "Passthrough or Filter an Incoming Claim" template and use the following:

    10853-sid.jpg

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest