5

Hi We have a sharepoint 2013 instance and we are setting up claims based authentication with SAML assertions (ADFS 3.0 IDP). I am able to grant access to a user by adding the user's email address to the web application's user policy. This works fine however I am unable to grant access by group.

I created claim type mappings for email,UPN,Role, and SID.

$emailClaimMap = New-SPClaimTypeMapping -IncomingClaimType   "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "EmailAddress" -SameAsIncoming
$upnClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" -IncomingClaimTypeDisplayName "UPN" -SameAsIncoming
$roleClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Role" -SameAsIncoming
$sidClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid" -IncomingClaimTypeDisplayName "SID" -SameAsIncoming

Here are the ADFS claim rules

ADFS Claim Rules

What is the correct way to grant access to a user based on group membership?

  • what error you are getting when type the group? are you typing group name or what? – Waqas Sarwar MVP Jun 4 '15 at 19:25
  • No error, I just get permission denied when I try to access the site as a user that is a member of the test group. I am typing in the Netbios name of the group (picker doesn't work since it's using an IDP). – m3ta Jun 4 '15 at 19:27
  • It looks like our settings match those in the link you referenced and I don't think the hotfix is applicable since we are on Sharepoint 2013. – m3ta Jun 4 '15 at 20:56
1

I figured it out. The group I was using was configured as a Distribution group and not a Security group.

Also, when using the picker for adding a user/group to a sharepoint group I had to mouse over the search result and make sure I selected the entry with the Role claim.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.