Custom ADFS 2 rule to add group names in Claim token

Setup: ADFS 2.0 server configured

Problem: The default rule “Send LDAP attributes as Claims” will add sAMAccountName attribute for every group in Claim token. If group name and sAMAccountName are different, you need custom rules to populate the Claim with group names.

Solution: Create the following two custom rules:

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
 => add(store = "Active Directory", types = ("http://sAMAccountName_role"), query = ";tokenGroups;{0}", param = c.Value);


c:[Type == "http://sAMAccountName_role"]
 => issue(store = "Active Directory", types = ("http://schemas.microsoft.com/ws/2008/06/identity/claims/role"), query = "sAMAccountName={0};name;DOMAIN\AnyUser", param = c.Value);