Start here if you haven’t already.
We’ll start with the last example — I’m piloting Yammer, I’ve got some users I want to grant access, but a whole lot more I want to deny. In the case of Yammer and likely some other RPs who don’t understand the Permit/Deny claim, you’ll have to manipulate something else to force the RP to boot you out. In Yammer’s case, they use the email address as the SAML_SUBJECT, which makes them pretty easy to poke.
Really, you should just update to ADFS 3.
But since that’s easier said than done, here’s how to make Yammer deny access to people using ADFS claims transformation rules.
Recursion? Did you mean recursion?
You’ll note from the previous post that we were denying users based on extensionAttribute1. This isn’t going to work any more, since Yammer doesn’t process the Deny claim, and punishes your insolence by stuffing you into an infinite redirect loop. The first thing you’ll want to do is remove any Issuance Authorization policies you have and put back ‘Allow all users.’
Next, we need to break users where extensionAttribute1 doesn’t equal false.
Persona Non Grata
In the case of Yammer, it’s easiest to just send in an invalid email address. Not invalid as in syntactically incorrect, but invalid for your organization.
That’ll give users a proper error message, informing them of their denial.
Two rules should do the trick (and you could probably get it down to a single composite rule) — one to transfer the email address to the SAML_SUBJECT and one to overwrite that claim if the user doesn’t have the requisite attributes.
To overwrite the claim (as opposed to adding a second value to the same claim), your issue statement should include the Issuer, OriginalIssuer and ValueType as the existing SAML_SUBJECT claim.
Something like this:
EXISTS(emailClaim:[Type == "http://schemas.microsoft.com.../emailAddress"]) && NOT EXISTS(c:[Type == "http://schemas.jpd.ms/unique/ad/Authorized", Value == "true"])
=> issue(Type = "SAML_SUBJECT", Value = "FAKE@domain.com", ValueType = emailClaim.ValueType, Issuer = emailClaim.Issuer, OriginalIssuer = emailClaim.OriginalIssuer);