0

I am trying to setup a custom trusted identity provider in SharePoint.

The provider issues a claim of type http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifierto uniquely identify the user.

If I use the argument -IdentifierClaim http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier in the command

$ap = New-SPTrustedIdentityTokenIssuer -Name $trustedTokenIssuerName -Description $trustedTokenIssuerName -Realm $realm -ImportTrustCertificate $cert -SignInUrl $providerUri -IdentifierClaim http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name -ClaimsMappings $map2,$map3

then I get the error

New-SPTrustedIdentityTokenIssuer : Identifier Claim currently selected is not in the list of mapped claims.
At C:\Users\nathan.davis\Desktop\Deploy\configTrustedIdentityProvider.ps1:48 char:7
+ $ap = New-SPTrustedIdentityTokenIssuer -Name $trustedTokenIssuerName -Descriptio ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : InvalidArgument: (http://schemas....ity/claims/name:String) [New-SPTrustedIdentityTokenIssuer], PSArgumentException
+ FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletNewSPIdentityProvider

However if I try to map the NameIdentifier claim like so:

$map1 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" -IncomingClaimTypeDisplayName "NameIdentifier" -SameAsIncoming

$ap = New-SPTrustedIdentityTokenIssuer -Name $trustedTokenIssuerName -Description $trustedTokenIssuerName -Realm $realm -ImportTrustCertificate $cert -SignInUrl $providerUri -IdentifierClaim $map1.InputClaimType -ClaimsMappings $map2,$map3

Then I get the error

New-SPClaimTypeMapping : The mapping is not allowed as the claim type
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier is a reserved claim type.
At C:\Users\nathan.davis\Desktop\Deploy\configTrustedIdentityProvider.ps1:42 char:9
+ $map1 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : InvalidArgument: (http://schemas..../nameidentifier:String) [New-SPClaimTypeMapping], PSArgumentException
+ FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletNewSPClaimMapping

How can I get SharePoint to use the http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier claim issued by the provider as the IdentifierClaim?

0

It doesn't appear to be possible to directly map the nameidentifier claim as itself. However, I was able to map it to a different local claim type and get it working, e.g.

 $map1 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" -IncomingClaimTypeDisplayName "NameIdentifier" -LocalClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"

 $ap = New-SPTrustedIdentityTokenIssuer -Name $trustedTokenIssuerName -Description $trustedTokenIssuerName -Realm $realm -ImportTrustCertificate $cert -SignInUrl $providerUri -IdentifierClaim $map1.InputClaimType -ClaimsMappings $map1,$map2,$map3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.