0

I have a question about claims based authentication. I have setup a webapp with claims and the claims are populated. Both authentication as well as authorization are working. But suppose my user has two claims: country and manager. And I now want to authorize all German managers to a certain resource. I would have to check for a combination of both; so a user having the 'Germany' country claims and the 'Yes' flag for manager.

Is this possible, or do I have to write some logic to combine the two into one and use that one for authentication, for instance saying 'German Manager'?

1

Your second guess is right, you have to write some logic to combine the two: merge both claims into a new claim, and give rights to this new claim.

When you say "claims based authentication", which provider are you using? Windows or trusted IDP (typically ADFS)?

If you're using ADFS, you could use the claims rule language in ADFS to add more claims to the user token. Alternatively on the Sharepoint side, you could write a custom claim provider, to create a new claim.

For instance, incoming claims:

Outgoing claims:

Edit: another option: buy a third-party tool, such as EmpowerID or some SaaS solution, to do the merging for you.

  • Hi Mathieu, thanks. We're using AD FS indeed, but not all claims originate there. We are going to use some custom logic to augment the token with additional claims, so I guess we'll be putting some combine logic in there as well. Can a user have multiple values for one claim, suppose he is appointed to both Germany and France for instance? – Jasper Oct 1 '14 at 7:21
  • Yes you can. However be careful, your identity claim must have only one value, otherwise authentication will fail. – Matthieu Oct 2 '14 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.