Need assistance converting ADFS rule to SAML Claim

Jose Perez 0

We are in the process of migrating ADFS apps to Entra ID SAML.

I need assistance in transforming this query to the SAML claim outgoing format we are using. The claim in ADFS is changing from the email user.lastname@domain to the UPN username@domain. Screenshot 2024-12-18 142625

Thanks.

Sanoop M 0 Reputation points Microsoft Vendor

2024-12-23T12:22:20.0566667+00:00
Hello @Jose Perez,

Thank you for posting your query on Microsoft Q&A.

Based on your description, you are in the process of migrating ADFS apps to Entra ID SAML.

Basically you need assistance in transforming this query to the SAML claim outgoing format that you are using. The claim in ADFS is changing from the email user.lastname@domain to the UPN username@domain.

Based on the Screenshot provided, we can see that you have used Send LDAP Attributes as claims as a Claim rule template in ADFS to send as claims to the Relying Party.

You have selected E-Mail-Addresses as an LDAP attribute and you have mapped it to UPN as an Outgoing Claim Type.

Basically, using the Send LDAP Attributes as Claims rule template in Active Directory Federation Services (AD FS), you can create a rule that will select attributes from a Lightweight Directory Access Protocol (LDAP) attribute store, such as Active Directory, to send as claims to the relying party. For example, you can use this rule template to create a Send LDAP Attributes as Claims rule that will extract attribute values for authenticated users from the displayName and telephoneNumber Active Directory attributes and then send those values as two different outgoing claims.

As per your requirement, you want to map the Email address(LDAP Attribute) to UPN(as an Outgoing Claim Type), but please note that by default for all the SAML integrated applications, for the Claim name: Unique User Identifier(Name ID), User Prinicipal Name(UPN) will be passed as a Default value. I am attaching the Screenshot below for your reference.

Please note that by default whenever the users try to sign in to all the SAML integrated applications, users will be successfully authenticated to the applications by entering their UPN and password. So could you please provide me the detailed description about exactly why you are mapping LDAP Attribute(Email-Addresses) to UPN(as an Outgoing Claim type) to be passed.

Please note that separately In Microsoft Entra ID, SAML claims can be added, configured and transformed by following the below steps:

Go to Microsoft Entra ID > select Enterprise Applications > Select your application > Select Single Sign-on > User Attributes & Claims > Click Edit and you can see the Required claims and also you can add additional claims by clicking on Add new claim as shown in the below Screenshot.

Please refer to the below document for your reference.

https://learn.microsoft.com/en-us/entra/identity-platform/saml-claims-customization

I hope this information is helpful. Please do let us know if you have any further queries.

Thanks and Regards,

Sanoop Mohan
Sanoop M 0 Reputation points Microsoft Vendor

2024-12-24T11:14:50.0766667+00:00

Hello @Jose Perez ,

We haven’t heard from you on the last response and was just checking back to see if you have any further queries.

Following up to see if the above suggestion was helpful. And, if you have any further queries please do let us know.

Thanks and Regards,

Sanoop Mohan

Share via

Need assistance converting ADFS rule to SAML Claim

Your answer