Active Directory group claims to relaying party trust

good morning people :),

go straight problem.

we trying create active directory groups on limit access owa , mapi outside company.

there 2 groups 1 granted permission other 1 declined permission.

the problem follows:

one of group denying access outside company , allowing access owa , mapi inside company. claim based on ip addresses using in company. unfortunatelly doesn't work. rules below.

exists([type == "h**p://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy"]) &&

exists([type == "h**p://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", value =~ "s-1-5-21-1177238915-764733703-1202660629-7711"]) &&

not exists([type == "h**p://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip",

value=~"\b10\.68\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-5][0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-5][0-5])\b"])

=> issue(type = "h**p://schemas.microsoft.com/authorization/claims/deny", value = "true");

exists([type == "h**p://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-proxy"]) &&

exists([type == "h**p://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", value =~ "s-1-5-21-1177238915-764733703-1202660629-7711"]) &&

not exists([type == "h**p://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip",

value=~"\b10\.68\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))"])

=> issue(type = "h**p://schemas.microsoft.com/authorization/claims/deny", value = "true");

 those rules in adfs proxy server.

there chance i've made mistake unfortunatelly i'm not expert solve self , need help.

thank you.

hi,

the value type x-ms-forwarded-client-ip has value not match regular expression “<public nat addresses>”. brings 2 important questions:

• where “x-ms-forwarded-client-ip” come , values should expect see there?
• what format of regular expression like?

“this ad fs claim represents “best attempt” @ ascertaining ip address of user (for example, outlook client) making request. claim can contain multiple ip addresses, including address of every proxy forwarded request. claim populated http header set exchange online, populates header when passing authentication request ad fs.”

so, value going border ip address exchange online (exo) sees client. either border firewall doing nat/pat or border proxy server. exchange online adds ip adfs claim request. perfect our outlook scenario here: outlook attempt connect exo, exo builds claims request includes client ip , heads out adfs endpoint submit request.

the second question bit easier (or perhaps bit harder—regular expressions can complicated) due fact regular expression format follows general rules regular expressions. internet full of regular expression examples filter ip addresses. example, let’s network has 1 block of addresses in use in nat pool: 192.168.4.0-192.168.4.255. have 1 satellite office single public ip address: 10.3.4.5. expression may use be:

“\b192\.168\.4\.([1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-5][0-9])\b|\b10\.3\.4\.5\b”

to break down:

\b192\.168\.4\.([1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-5][0-9])\b applies 192.168.4.0-255 network.

\b192\.168\.4\. matches 192.168.4.

[1-9] matches address ending in 1-9

[1-9][0-9] matches 10-99

1[0-9][0-9] matches 100-199

2[0-5][0-9] matches 200-259 (yeah…i know few more needed)

the ‘|’ represent “or”

\b10\.3\.4\.5\b applies 10.3.4.5 address.

these can tricky. recommend use regular expression verification tool , test.

finally, if of these conditions true:

=> issue(type = "http://schemas.microsoft.com/authorization/claims/deny", value = "true");

we deny claim.

if 1 of elements of rule evaluate false, entire rule skipped. so, if client coming 1 of addresses match regular expression, not match rule.

for more information, can refer article below.

http://blogs.technet.com/b/askds/archive/2012/06/26/an-adfs-claims-rules-adventure.aspx

it seems issue more relate ad fs claims. if have questions, maybe can post question claims based access platform (cba), code-named geneva forum ad fs experts resolve problem.

you post problem link below.

http://social.msdn.microsoft.com/forums/vstudio/en-us/home?forum=geneva

best regards,

jay

Windows Server  >  Directory Services