Send objectGUID as an AD FS 2.0 Claim

Question

I would like to send objectGUID as a claim with AD FS 2.0 running on Windows Server 2012.

I know I can create Issuance Transform Rules for a Relying Party Trust, but how does AD FS 2.0 know about objectGUID? Do I need to add a claim description for objectGUID under AD FS\Service\Claim Descriptions?

Solution 1

The objectGuid LDAP attribute can be sent as the value of any claim by using "Send LDAP Attributes as Claims Rule" and specifying objectGuid as the source attribute. ADFS has no specific knowledge of LDAP attributes, and if you were to extend your LDAP schema, you could use those just as easily as any other. The particular claim you must transform it to is mandated by the relying party.

If you are just using it as the user's unique ID, you might send it as http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier (Private Personal Identifier), but you might also send it in a claim specific to your particular RP (which is when you would need to add a claim description).

Solution 2

Refer ADFS : objectGUID as a claim.

The problem isn't so much accessing it but the fact that it "converts" it to something that doesn't match the original entry in AD.

Comments

[Wes]

you're blog post was helpful in discovering the base64 behavior with AD FS. I'm not so concerned that the value sent as the AD FS claim is not the actual value. My main concern is that I am able to extract a unique/immutable value for each user.