What are the full claim encodings for the SharePoint and Windows Built-In groups?

Question

When claims authentication is used in SharePoint 2013, groups that were previously easy to identify are now much harder to decipher. For example,

"All Authenticated Users" = "c:0(.s|true" 
"Windows Authenticated Users" = "c:0!.s|windows"

If you look at SharePoint 2013 and SharePoint 2010 claims encoding, you can find out how to decode the first part of the encoding, but I am unable to find a link that translates the claim value itself. That is, what "true" or "windows" maps to, or the other way around.

So my question is, what are the claim encoding to group translations for built-in Windows or SharePoint groups? A simple list here would be great.

For context, I am in the process of adding support for SharePoint 2013 to an application that uses the Component Object Model (COM). The application (.NET 4) simultaneously needs to support both claims-based and classic-mode authentication for SharePoint. The application needs to be able to get the members of the group and I need the classic name to do that.

Answer 1

Whereas not answering your question exactly, it is very easy to get the "real" user object from a claim:

SPClaimProviderManager claimManager = SPClaimProviderManager.Local;
SPClaim claim = SPClaimProviderManager.Local.DecodeClaim(userLoginName);           

The important part being the DecodeClaim method.

More information:

• Determining the original issuer of a user identity claim in SharePoint 2010
• Programmatically converting login name to claim and vice versa

---

As for decoding the claim value as you asked in your question, you will first have to figure out the claim type, as well as the claim value type. The ClaimValueType you have right in the claim string, the claim type you have to deduct yourself (by looking at the ClaimType within the claim string). Depending on this information you have to handle the claim value yourself and do whatever you want with it.
Your example is actually explained right on the page you linked to. The All Authenticated Users" is actually a special case not explained there. Another special case would be all users from your sql forms authentication which would be "c:0!.s|forms:aspnetsqlmembershipprovider".