ADFS Custom Claim Rule email To LowerCase SAML Response

Question

I am trying to create a custom claim rule in adfs to re-write the email address to NameId but in lowercase.

The reason is Responsys reads the claims and is case sensitive when comparing the NameId in the SAML Response it fails. Our Active Directory has email address as mixed case for some users and lowercase for others. e.g. LJeary@ or ljeary@

I have added a custom attribute store to do the lowercase part but I am not seeing the Claim in the SAMLResponse.

as per http://macintheoffice.com/?q=node/5

I need help to create a custom claim rule which will successfully send the email address as lowercase in the outgoing claim NameID

Should see this

   <Subject>
        <NameID>[email protected]</NameID>
        <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
            <SubjectConfirmationData NotOnOrAfter="2017-05-10T03:24:20.358Z" Recipient="https://interact2.responsys.net/authentication/login/loginSSO" />
        </SubjectConfirmation>
    </Subject>

but see this

    <Subject>
        <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
            <SubjectConfirmationData NotOnOrAfter="2017-05-10T03:24:20.358Z" Recipient="https://interact2.responsys.net/authentication/login/loginSSO" />
        </SubjectConfirmation>
    </Subject>

missing the NameID attribute.

Custom Claim Rule used is

    c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]
 => issue(store = "StringProcessing", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"), query = "toLower", param = c.Value);

answer: Thanks @nzpcmad . Came up with a similar process by returning the email address and storing in an incoming claim. Then creating another rule to take the email incoming claim transform to lower and assign to outgoing claim NameID.

ADFS Claim Rules

Answer 1

Are you sure that something is being returned from the custom attribute store?

The error could be because of a missing NameID format.

Try returning a dummy claim e.g. http://company/temp which contains the lower case email and then use a Transform rule to transform the dummy claim to NameID.

You could also code this yourself.

Or if you like typing :-)

Answer 2

As @nzpcmad suggests, you can do this by issuing a temporary claim, then using RegExReplace to convert it to lowercase. While inelegant, it does result in a solution that requires no installations on the AD FS server.

Example with UPN going to a custom claim as lowercase:

Rule 1:

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
 => add(store = "Active Directory", types = ("urn:temp_upn"), query = ";userPrincipalName;{0}", param = c.Value);

Rule 2:

c:[Type == "urn:temp_upn"]
 => issue(Type = "https://aws.amazon.com/SAML/Attributes/RoleSessionName", Value = RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(RegExReplace(c.Value, "A", "a"), "B", "b"), "C", "c"), "D", "d"), "E", "e"), "F", "f"), "G", "g"), "H", "h"), "I", "i"), "J", "j"), "K", "k"), "L", "l"), "M", "m"), "N", "n"), "O", "o"), "P", "p"), "Q", "q"), "R", "r"), "S", "s"), "T", "t"), "U", "u"), "V", "v"), "W", "w"), "X", "x"), "Y", "y"), "Z", "z"));