What are the claims supported by SharePoint?

Question

I am passing Claims from a custom STS to SharePoint. It seems that some of the Claims are coming through OK to SharePoint, but not all. For example I am passing in the GivenName and Surname claims, but in the SharePoint "My Settings" page, I do not see a First Name or Surname populated.

My claim mappings are as follows:

PS C:\Users\tom.haigh> $sts.ClaimTypeInformation


DisplayName                    : WebUsername
InputClaimType                 : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
MappedClaimType                : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
IsIdentityClaim                : True
AcceptOnlyKnownClaimValues     : False
ClaimValueModificationAction   : None
ClaimValueModificationArgument :
KnownClaimValues               : {}
UpgradedPersistedProperties    : {}

DisplayName                    : Email
InputClaimType                 : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/email
MappedClaimType                : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mail
IsIdentityClaim                : False
AcceptOnlyKnownClaimValues     : False
ClaimValueModificationAction   : None
ClaimValueModificationArgument :
KnownClaimValues               : {}
UpgradedPersistedProperties    : {}

DisplayName                    : Windows Account Name
InputClaimType                 : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/windowsaccountname
MappedClaimType                : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/windowsaccountname
IsIdentityClaim                : False
AcceptOnlyKnownClaimValues     : False
ClaimValueModificationAction   : None
ClaimValueModificationArgument :
KnownClaimValues               : {}
UpgradedPersistedProperties    : {}

DisplayName                    : Given Name
InputClaimType                 : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
MappedClaimType                : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
IsIdentityClaim                : False
AcceptOnlyKnownClaimValues     : False
ClaimValueModificationAction   : None
ClaimValueModificationArgument :
KnownClaimValues               : {}
UpgradedPersistedProperties    : {}

DisplayName                    : Surname
InputClaimType                 : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
MappedClaimType                : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
IsIdentityClaim                : False
AcceptOnlyKnownClaimValues     : False
ClaimValueModificationAction   : None
ClaimValueModificationArgument :
KnownClaimValues               : {}
UpgradedPersistedProperties    : {}

I am interested to find out what claim types are supported, and how to make them work as expected.

Answer 1

AFAIK, there is no automatic mapping between claims and the My Settings page. For instance, providing an "email" claim does not populate the "email" field.

You can pass as many claims to Sharepoint as you want, but the only claim that Sharepoint is interested in is the Identity claim; it is used as a unique identifier (similar to the UPN in Windows-classic authentication) and as a "display name" (the Name field on the My Settings page). All other claims pass through Sharepoint without being used.

The only place where you can see and use all your claims is when you specify authorizations through the People Picker; here you will see all of them, and you can grant access to content using the claim you want.

If you want a mapping to occur, you must configure the User Profile Sync Service.

So to summarize:

1. The identity claim is used to uniquely identify a user and as a default "display name".
2. All other claims may be used for authorization.
   Note: some claim types are reserved by Sharepoint and cannot be mapped, such as Name and NameIdentifier. You will receive an error if you try to use them, when you setup your mappings.
3. If you want to populate the email, display name, etc, in My Settings, configure the User Profile Sync service.
   Note: there are some additional steps to perform when you use claims-based auth, such as setting the "Claim User Identifier" property.

PS. If you want to see your claims, the code accompanying the following article has a really nice web part that shows all claims with their values:
http://msdn.microsoft.com/en-us/library/ff953202.aspx

Answer 2

I must admit that I haven't had much experience with claims but I'll have a stab at this one in the absence of any other responses.

User profile properties (located within the "My Settings" page) are simply name/value pairs that are imported from a directory such as AD.

At a guess I would say that the user profile properties that appear to match the users claims are the default ones that are imported by the User Profile Service from Active Directory.

It sounds as though you are augmenting claims and expecting them to appear within the user's profile, whereas the solution might be to add custom properties within the Manage Profile Service page.

Answer 3

if you want to set the information of given name, email, Department, and other properties user can see on "My Settings" page, you need to implement a custom claims provider, and in FillResolve method set the PickerEntity

        pe.EntityData[PeopleEditorEntityDataKeys.DisplayName] = "GivenName";
        pe.EntityData[PeopleEditorEntityDataKeys.Email] = "someone@domain.com";

checkout all properties you can set