Home / server / Questions / 676916
Accepted
hardmod
Asked: 2015-03-20 22:42:42 +0800 CST

ADFS - Restrict to AD Group

  • 772

I just implemented an ADFS server to connect a third-party chat tool with our Active Directory via SAML 2.0.

Everything works fine so far but there's a little problem: As soon as a user logs in, the chat tool creates an account for him automatically. That's a problem because every account causes fees.

Is there any way to restrict the ADFS usage to an AD Group?

active-directory

1 Answers

  1. Best Answer

    This can be done by adding a so-called Issuance Authorization Rule.

    Step-by-step:

    • Open AD FS Management Center
    • Expand Trust Relationsships
    • Select Relying Party Trusts
    • Right click the required trust
    • Click Edit Claim Rules
    • Goto the Issuance Authorization Rules tab
    • Delete the default Permit Access To All Users rule
    • Click Add Rule
    • Select Permit or Deny Users Based on an Incoming Claim
    • Incoming Claim Type, select Group SID
    • Click Browse at Incoming claim value
    • Select the required group
    • You're done
    • 20