0

I was hoping to find an example where I could add a particular custom claim value to a SP group using PnP Powershell.

Basically do what is done below using PnP powershell

$ClaimValue = $_.ClaimValue
    if ($_.ClaimType -eq $ClaimTypeSchema.GroupSID)
    {
      $objUserAccount = New-Object System.Security.Principal.NTAccount($EnvUserDomain, $_.ClaimValue)
      $objUserSID = $null
      Write-Output ("Generating Security Identifier for account: '" + $_.ClaimValue + "' ...")
      $objUserSID = $objUserAccount.Translate([System.Security.Principal.SecurityIdentifier])
      if ($objUserSID -eq $null)
      {
        continue
      }
      $ClaimValue = $objUserSID.Value
    }
    Write-Output ("   Adding Claim: '" + $_.ClaimType + "' with Value: '" + $ClaimValue + "' ...")
    $Claim = New-SPClaimsPrincipal -ClaimType $_.ClaimType -ClaimValue $ClaimValue -TrustedIdentityTokenIssuer $AuthenticationProvider
    $SPUserClaim = New-SPUser -UserAlias $Claim.ToEncodedString() -Web $RootWeb.Url
    $SecurityGroup.AddUser($SPUserClaim)
  }
  Write-Output "Completed"

1 Answer 1

0

looks like I can get away with hardcoding the expected formats using something like below

i:0ǵ.t|custom-adfs|First.Last

for more encodings refer to the article below

https://social.technet.microsoft.com/wiki/contents/articles/13921.sharepoint-20102013-claims-encoding.aspx

Still I think it would be good to have a equivalent in PnP.

$Claim = New-SPClaimsPrincipal -ClaimType $_.ClaimType -ClaimValue $ClaimValue -TrustedIdentityTokenIssuer $AuthenticationProvider
$SPUserClaim = New-SPUser -UserAlias $Claim.ToEncodedString() -Web $RootWeb.Url

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.