ADFS Claim Rule (Not a member of group sid)

I am configuring ADFS Claim Rules to work with SalesForce.  When a specified group id is specified for the claim (check for equals), single sign on works without any problems.  How do you create a claim rule based on AD groups the user is not a member of?
LVL 9
BlueYonderAsked:
Who is Participating?
 
btanExec ConsultantCommented:
You can check this out
http://technet.microsoft.com/en-us/library/ff678036(v=ws.10).aspx

ALso thought this article is good ref as well, which shared some part on "- ADFS Claim Rules (Transform)" which states example of "@RuleTemplate = "EmitGroupClaims""

http://blog.force365.com/2012/12/28/salesforce-sso-with-adfs-2-0/

Special customisation
http://social.msdn.microsoft.com/Forums/eu/Geneva/thread/8520c800-189d-4279-8b81-d6a3eb3c6e87
0
 
arnoldCommented:
What are you looking to do? Are you trying to do a negative? I.e. is user Is not a member f X, do y?
You can assign an ad group a mask that is unique using power of 2 for each group the sum of the masks of all the groups a user is a member of, then checking the mask against your rule (logical and) whatever the result will be the matching groups. And you can apply whatever you want.
The above will be what is common.

To do the opposit you can invert the user mask and then logically and with all ones.
This will give the mask of groups that the user is not a member of to do with as you will.

IMHO, it is always best to setup rules based on an affirmative membership rather than trying to prove a negative.  The issue with either approach is that you have to actually enumerate all groups to make sure a group to which a user belongs is not itself a member of yet another group.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.