Forum Discussion
SP 2016 ADFS 4.0 Federated Partner Authenticates, but doesn't Authorize
- What claims are you passing over the fed trust and what is the identity claim configured in SharePoint/sent by the RP from the resource domain ADFS?
Thanks Trevor ... although the claim itself wasn't necessarily the resolution, it DID point me in the direction that seems to have resolved the issue.
I went to the claims provider in sharepoint (LDAPCP) and added another connection for the federated domain. Although in a typical federated scenario, I question the feasibility of this as a solution, for OUR environment this works and users from the federated ADFS forest are now able to be added into a site with permissions, and thus are authorized after authenticating.
User ADFS Issuance
UPN - passthrough
Primary Sid - passthrough
Primary group SID - passthrough
Name - passthrough
UPN --> emailAddress
Resource ADFS
UPN - passthrough
Primary Sid - passthrough
Primary group SID - passthrough
Name - passthrough
Email - passthrough
UPN --> emailAddress
SharePoint Identifier Claim = email
