We are setting up a new SharePoint 2013 environment and are using ADFS for User Authentication. We used the configuration that is described in the following Technet article: https://technet.microsoft.com/en-us/library/hh305235.aspx
At first glance everything seems to be working, but during testing we encountered the following issue:
Every user can access all information inside of SharePoint. Even sites or lists to which they do not have SharePoint permissions.
This seems to be caused by the fact that these users are added to a User Policy which provides them access to the entire web application (as described in the section 'Configure permissions to access the web application').
It seems that the permissions that are granted in the User Policy take precedence over the permissions that are granted in SharePoint itself.
How would we be able to prevent this and let SharePoint permissions take precedence over the policy that are granted in the Web Application User Policy?