In my environment we are running Exchange 2013 Hybrid. All mailboxes are in O365. We have certain requirements around our implementation that require ADFS. With that being said, I am really struggling with coming up with the set of claims based rules to accomplish my goal. Our ADFS environment is in Azure (vpn to on-prem network, 1 DC, 2 ADFS servers, 2 ADFS Proxy). Federation itself is up and running fine. I feel like I have read the same handful of technet / blog post articles on setting this up but I must be missing something. I am also struggling with being able to debug / trace to see excatly which claims are coming in with their values to determine why I am not getting expected results
Here are the scenarios that I need (and have rules for):
1. Block external Outlook access unless user is in the ADFS_Allow External Outlook AD Security Group
exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy"])
&& exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-endpoint-absolute-path", Value == "/adfs/services/trust/2005/usernamemixed"])
&& exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-application", Value == "Microsoft.Exchange.Autodiscover|Microsoft.Exchange.OfflineAddressBook|Microsoft.Exchange.RPC|Microsoft.Exchange.WebServices"])
&& NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip", Value =~ "\bXXX\.XXX\.XXX\.XXX\b|\bXX\.XX\.XX\.XX\b|\bXX\.XX\.XX\.XX\b"])
&& NOT exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value =~ "\bS-1-5-21-XXXX-XXXX-XXXX-XXX2\b"])
=> issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "true");
2. Block external OWA unless user is in the ADFS_Allow External OWA AD Security Group
exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy"])
&& exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-endpoint-absolute-path", Value == "/adfs/ls"])
&& NOT exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value =~ "\bS-1-5-21-XXXX-XXXX-XXX-XXX\b"])
&& NOT exists([Type == "http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip", Value =~ "\bXXX\.XXX\.XXX\.XX]\b|\bXX\.XXX\.XX\.XX\b|\bXX\.XX\.XX\.XX\b"])
=> issue(Type = "http://schemas.microsoft.com/authorization/claims/deny", Value = "true");
In both examples the IP addresses included in the regex are the public IP addresses of our 3 locations. IP and SID have been redacted.
I have looked at the insidecorporatenetwork rule vs the proxy / forwarded-client-ip -- and either way, I can't seem to get anywhere. I would really love to be able to trace end-to-end to view all of the claims and values to understand why someone is allowed / denied access.
Any help in pointing me in the right direction would be greatly appreciated.
Steve
