Search code examples
single-sign-onsaml-2.0adfs3.0

Adding claim details from SQL Server (Not from Active Directory) in SAML 2.0 Response using ADFS 3.0

I am implementing SSO with SAML 2.0 with IDP initiated flow.Use of a third party IDP is not an option and we will have to use the ADFS 3.0 that comes with Windows Server 2012R2. We have a CRM tool and users are authenticated using their AD account.When the user tries to access account details of our customers in another system, IDP has to pass the username of the customer(This is stored in SQL server database).My question is, Is there any way for us to include that details in the SAML 2.0 Response that we send to our SP.My understanding is that all the claim details that we send to SP should come from AD if we are using ADFS.Is this not the case? If not do I have any control over modifying the claim details in the SAML 2.0 Response in the code(C#) before sending that to the SP? I thought sending SAML 2.0 is done by the ADFS and my application logic has no control over that

Edit: I did more research and found this SO post authentication against ADFS, authorization against sql server this seems like it is pulling the credentials of the logged in user .In my case , I need to get the user info of the customer from another database based on the account# the user selects.Is there a way to do this?

Here is the use case

  1. Internal user(user) logs into our CRM app with AD credentials
  2. Searches for a customer and finds an account# for the customer
  3. User tries to access the account details for this customer on a SP
  4. User is taken to the SP url(username of the customer gets passed as a query string)
  5. SP does an HTTP POST SAML Authentication request to IDP(I assume this is inside a post with RelayState and base64 encoded
  6. Should i create a web api to capture this and get the RelayState and offload this to ADFS via WIF?
  7. If step 6 is possible,can I get the generated SAML Response back from ADFS,encrypt that and send that back to SP?If step 6 is not possible,is ADFS sending the SAML response with encrypted data back to the SP?
  8. Also is there a requirement to wrap SAML Request and Response inside a form html element for web sso?

sso_workflow

Any help would be appreciated

Solution

  • As per the link, you can get attributes from SQL DB for authorisation.

    This is via a claims rule.

    There is nothing stopping you have more than one SQL DB and get different attributes from each

    These attributes are all added as claims in the SAML token.

    You can use normal claims rule manipulation as well.