Versions Compared

Old Version 20

changes.mady.by.user Matt Schroeder

Saved on

compared with

New Version 21

changes.mady.by.user Matt Schroeder

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

@Rulename="Transform sAMAccountName to EPPN"
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"]
 => issue(Type = "urn:oid:1.3.6.1.4.1.5923.1.1.1.6", Value = c.Value, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/attributename"] = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri");
@Rulename="Transform EPPN & add scope"

c:[Type == "http://schemas.xmlsoap.org/claims/Group", Value == "Domain Users"]
 => issue(Type = "urn:oid:1.3.6.1.4.1.5923.1.1.1.6", Value = "member@yourdomain.edu", Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/attributename"] = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri");

Example of eduPersonPrincipalName(EPPN) mapped to sAMAccountName.  Like the above example, the EPPN needs to be unique not only to your organization but to others as well.  The sAMAccountName doesn't have the domain value added, the below example you creates three custom rules.   The first queries AD for sAMAccountName & upn, the second pulls the domain value from the upn, the third adds the domain value to the sAMAccountName and gives it the EPPN value.  

@Rulename="Query AD for upn and sAMAccountName"
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
 => add(store = "Active Directory", types = ("ssupn", "sswindowsaccountname"), query = ";userPrincipalName,sAMAccountName;{0}", param = c.Value);


@Rulename="Obtain the domain from the upn"
 
 c:[Type == "ssupn"]
 => add(Type = "ssnewupn", Value = RegExReplace(c.Value, "^(.*?)@", ""));

@Rulename="Combine sAMAccountName with domain"
 
c1:[Type == "ssnewupn"]
&& c2:[Type == "sswindowsaccountname"]
=> issue(Type = "urn:oid:0.9.2342.19200300.100.1.1", Value = c2.Value + "@" + c1.Value, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/attributename"] = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri");






Example of eduPersonAffiliation stored in title:

...