Use custom claim description to send group membership from AD FS to ETP
Before you begin
Claims rules control which Active Directory (AD) attributes are returned to the relying party endpoint once a user has been authenticated. For example, it could be the application user’s email address or user’s AD group membership information. The minimum requirement for ETP is the user’s email address. It needs to be returned as a part of the Name ID attribute.
The IT administrator can create a custom claims description in AD FS, associate it with the correct LDAP attribute, and add it to the relying party trust. This allows AD FS to send the user’s group membership to ETP.
- Go to .
- Expand Service and select Claim Descriptions.
- On the right, click Add Claim Description....
Complete these fields in the Add
a Claim Description window:
- Display name. Enter a display name. For example, Group (ETP)
- Short name. Enter a short name. For example, groupetp.
- Description. Enter a description. This is optional.
- Click OK.
- Right-click on the relying party trust (for example, IDP-RPT) and select Edit Claims Issuance Policy...
- Click Add Rule...
Select the default Send LDAP Attributes as Claims
template. This template allows the IT administrator to use any of the LDAP
attributes for claim rules.
The Add Transform Claim Rule wizard appears.
Complete these fields:
- Claim rule name. Enter a custom claim rule name.
- Attribute store. Select Active Directory.
Map an LDAP attribute to an
Outgoing Claim Type. Select
Token-Groups for LDAP attribute and Group (ETP) from
This associates your custom claim description to the Token-Groups LDAP attribute, enabling the handling of group memberships between AD FS and Akamai Enterprise IdP. In this example, the IT administrator configures a claim rule called “Group Membership Attribute” that fetches the SAML group assertion attribute from the Active Directory and sends it out to relying party trust, which is Akamai Enterprise IdP.
- Click Finish.
- Click OK to save in the Edit Claim Rules dialog box.