First, let me describe the scenario:
I have a Web Application with 2 enabled Identity Providers
- Windows Authentication
- Custom Trusted Identity Provider (that provider handles PingFederate SAML tokens)
All users that will access SharePoint are members of an Active Directory domain (the SharePoint farm is member of the same domain). Permissions to SharePoint content is granted based on Active Directory groups.
Now there are two ways how to "reach" the SharePoint.
- Way A: Some users log on to their PC (which means: they log on to the domain) and access SharePoint using Windows Authentication. No problem with that way.
- Way B: Some other users DO NOT log on to the domain using their PC. Instead they log on to a web portal which issues a PingFederate SAML token. This token is used to authenticate the user in SharePoint via the Trusted Identity Provider.
Now the challenge:
Since every user is member of the Active Directory domain, those users who are using way B should be treated as if they've had used way A; they should be mapped to their appropriate AD account using the login ID from the web portal (web portal ID and AD SamAccountName are equal). Means: the PingFederate SAML token (the SAML claim) should somehow be converted to a Windows Authentication token (Windows Claim), if that's possible. Those users (way B) should be displayed in SharePoint the same way as users of way A. Furthermore users of way B should be granted access to content via Active Directory groups.
Is this possible? Can someone please give some hints how to achieve that (Custom Claims Provider)? Do I need to augment claims (AD group membership) for those users coming over way B? Is there a way to convert SAML tokens from (in this case) PingFederate SAML token to Windows Authentication SAML token?