Home / server / Questions / 945947
In Process
Anton Gogolev
Asked: 2018-12-20 01:47:55 +0800 CST

How to test AD FS 2.0 Claim Transformation Rule?

  • 772

Is there any way to do a test run on the the AD FS Claim Transformation Rule (as in this)?

I have a valid SAML response, I have a more-or-less valid CTR, but how on Earth can I run the CTR against the SAML response to actually see the result of the transformation?

Case in point. This is the SAML response:

<samlp:Response Version="2.0" ID="rABny-Np-JQ4Gfg1S7x3Mtb71KX" IssueInstant="2018-12-14T12:47:12.591Z" InResponseTo="id-2328a4b7-c905-428e-a0c7-bc163f6ab1f4" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">...</saml:Issuer>
    <samlp:Status>
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </samlp:Status>
    <saml:Assertion ID="wPg-7mgx97wCreyIZNLuQG5O5sc" IssueInstant="2018-12-14T12:47:13.075Z" Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml:Issuer>se-idp</saml:Issuer>
        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
                <ds:Reference URI="#wPg-7mgx97wCreyIZNLuQG5O5sc">
                    <ds:Transforms>
                        <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                    <ds:DigestValue>Zzkf8Kzwtqj2fx/fIyVt6FnMTXLWy+BEApwzqFqzEHo=</ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>...</ds:SignatureValue>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>..</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </ds:Signature>
        <saml:Subject>
            <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">SESA442598</saml:NameID>
            <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml:SubjectConfirmationData Recipient="https://sso.example.com/adfs/ls/" NotOnOrAfter="2018-12-14T12:52:13.075Z" InResponseTo="id-2328a4b7-c905-428e-a0c7-bc163f6ab1f4"/>
            </saml:SubjectConfirmation>
        </saml:Subject>
        <saml:Conditions NotBefore="2018-12-14T12:42:13.075Z" NotOnOrAfter="2018-12-14T12:52:13.075Z">
            <saml:AudienceRestriction>
                <saml:Audience>http://sso.example.com/adfs/services/trust</saml:Audience>
            </saml:AudienceRestriction>
        </saml:Conditions>
        <saml:AuthnStatement SessionIndex="wPg-7mgx97wCreyIZNLuQG5O5sc" AuthnInstant="2018-12-14T12:47:13.044Z">
            <saml:AuthnContext>
                <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
            </saml:AuthnContext>
        </saml:AuthnStatement>
        <saml:AttributeStatement>
            <saml:Attribute Name="mail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                <saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">[email protected]</saml:AttributeValue>
            </saml:Attribute>
            <saml:Attribute Name="sAMAccountName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                <saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">JA234123</saml:AttributeValue>
            </saml:Attribute>
        </saml:AttributeStatement>
    </saml:Assertion>
</samlp:Response>

And this is the CTR I'm trying to use to transform the /Attribute/@Name="mail" to a claim we're expecting:

c:[Type == "mail"] => 
  issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType);
adfs

1 Answers

  1. You have to run it end to end.

    If you are getting the claim from somewhere else (i.e. not from AD) you need to use a pass-through rule on the CP.

    Use a pass-through rule and then a transform rule.

    On the RP side, add a pass-through rule for the transformed claim.

    • 0