Dear all,
We are in process of configuring external authentication using SAML and ADFS on ESA, but are having problems configuring IDP side. User guide for AsyncOS is pretty vague in that part, with sample custom rule returning error (it is obvious why), and Issuance Transform Rule part being unclear on exact LDAP Attribute / Outgoing Claim Type to choose for Email/Group. Is there anyone with working ESA SAML integration with ADFS that can share Issuance Transform Rules information from ADFS?
Add a custom rule to include SPNameQualifier in the response. The following is a sample custom rule:
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"] =>
issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer=
c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType,
Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] =
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
Properties ["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] =
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified");
Edit the Claim Rule and add an Issuance Transform Rule to send the LDAP attribute for email address as an outgoing claim type (email address). Also ensure that you add an Issuance Transform Rule to send the LDAP attribute for group attribute as an outgoing claim type (unspecified groups).
Best regards
