Although there are tons of information about this, I could not find single place, where it would be described how it actually works.
Situation is this, in WSS 3.0 we were using external user id (long) as user name (in database that was tp_login field), now we are migrating to claims with using custom STS and if I understand correctly, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name is reserved, so when I register New-SPTrustedIdentityTokenIssuer I can't map to it my previous user id.
Many examples use email as IdentifierClaim, but I don't understand how it maps to database field, also my identifier is not email, so wondering how should I map it, should I perform any configuration after registering identity token issuer, to say how it relates to database fields or I misunderstand something fundamentally?
After digging more, I think I candescribe my problem in a shorter way:
I have a user in database
i:0#.f|fbamembers|user1 and it has own permissions, etc.
When I connect using custom sts user identity looks like:
Is there a way, that I could map sts user to forms user and would not need to duplicate all the permissions?