{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40649,"path":"platform-security/authentication/t_ConfigureADFSClaimRules.md","title":"Configure the ADFS relying party claim rules","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure the ADFS relying party claim rules\n\nEdit the claim rules to enable proper communication with the instance.\n\n## Before you begin\n\nRole required: sso\\_config\\_admin, business\\_rule\\_admin, script\\_include\\_admin\n\n## Procedure\n\n1.  Log into the ADFS server and open the management console.\n\n2.  Right-click the relying party trust and select **Edit Claim Rules**.\n\n3.  Click the **Issuance Transform Rules** tab.\n\n4.  Select **Add Rules**.\n\n5.  Select **Send LDAP Attribute as Claims** as the claim rule template to use.\n\n6.  Give the claim a name such as `Get LDAP Attributes`.\n\n7.  Set the **Attribute store** to `Active Directory`, the **LDAP Attribute** to `E-Mail-Addresses`, and the **Outgoing Claim Type** to `E-mail Address`.\n\n    \\[Omitted image \"Adfs-editReplyingPartyClaimRules-01.png\"\\] Alt text: Get attribute.\n\n    ```\n    c:[Type == \"http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname\", Issuer == \"AD AUTHORITY\"]  \n    => issue(store = \"Active Directory\", \n    types = (\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"), \n    query = \";mail;{0}\", param = c.Value);\n    \n    ```\n\n8.  Select **Finish**.\n\n9.  Select **Add Rules**.\n\n10. Select **Transform an Incoming Claim** as the claim rule template to use.\n\n11. Give the Claim a name such as `Email to Name ID`.\n\n12. Set the **Incoming claim type** to the **Outgoing Claim Type** in the previous rule.\n\n    For example, `E-Mail Address`.\n\n13. Set the **Outgoing claim type** to `Name ID` and the **Outgoing name ID format** to `Email`.\n\n    **Note:** These values must match the [Name ID policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/t_SetUpNameIDPolicy.md) you define during SAML 2.0 configuration.\n\n14. Select **Pass through all claim values**.\n\n    \\[Omitted image \"Adfs-editReplyingPartyClaimRules-02.png\"\\] Alt text: Email to Name ID.\n\n    This claim rule should look similar to the following rule language.\n\n    ```\n    c:[Type == \"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"]\n     => issue(Type = \"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier\", \n    Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, \n    Properties[\"http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format\"] \n    = \"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\");\n    \n    ```\n\n15. Click **Finish**.\n\n\n"}}