asked on

ASFS 3.0 Additional Claim Rules using PowerShell Problems

We are trying to add any additional claim rule on one of our ADFS relaying party trust using the command below, But keep getting the Powershell error Get-Content positional parameter cannot be found that accepts argument 'System.object"

set-adferelyingpartytrust -name ABC -additionalauthenticationrule c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value == "S-1-5-2xxxxxxxxxxxxxxx"] -and [Type == "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value == "false"] -and [Type == "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value == "true"] => issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", Value = "http://schemas.microsoft.com/claims/multipleauthn");

oBdA

Passing string arguments without quotes only works up to a certain point. Try to put the string for AdditionalAuthenticationRules inside quotes; easiest to use here are single quotes, since the string contains double quotes that would need to be escaped otherwise (but note that you can't use variables inside a single-quoted string).

Set-AdfsRelyingPartyTrust -Name ABC AdditionalAuthenticationRules 'c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value == "S-1-5-2xxxxxxxxxxxxxxx"] -and [Type ==  "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value == "false"] -and [Type ==  "http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value == "true"] => issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", Value = "http://schemas.microsoft.com/claims/multipleauthn")'

Open in new window

compdigit44

ASKER

Getting the message below...

Set-AdfsRelyingPartyTrust : Parameter set cannot be resolved using the specified named parameters.
At line:1 char:1
+ Set-AdfsRelyingPartyTrust -Name TrustTest1 -AdditionalAuthenticationRules 'c: ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Set-AdfsRelyingPartyTrust], ParameterBindingException
+ FullyQualifiedErrorId : AmbiguousParameterSet,Microsoft.IdentityServer.Management.Commands.SetRelyingPartyTrustC

oBdA

Can't test this. According to https://docs.microsoft.com/en-us/powershell/module/adfs/set-adfsrelyingpartytrust?view=win10-ps
Try -TargetName TrustTest1 instead of "-Name TrustTest1"

compdigit44

ASKER

I get this message when using -TargetName..

Set-AdfsRelyingPartyTrust : POLICY0002: Could not parse policy data.
Line number: 1, Column number: 139, Error token: -. Line: 'c:[Type ==
"http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value ==
"S-1-5-21-489560845-1771796962-2032737499-178925"] -and [Type ==
"http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value == "false"] -and [Type ==
"http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", Value == "true"] => issue(Type =
"http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", Value =
"http://schemas.microsoft.com/claims/multipleauthn")'.
Parser error: 'POLICY0029: Unexpected input.'
At line:1 char:1
+ Set-AdfsRelyingPartyTrust -TargetName "ServiceNowDev" -AdditionalAuthenticationR ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (Microsoft.Ident...lyingPartyTrust:RelyingPartyTrust) [Set-AdfsRelyingPart
yTrust], PolicyValidationException
+ FullyQualifiedErrorId : POLICY0002,Microsoft.IdentityServer.Management.Commands.SetRelyingPartyTrustCommand

ASKER CERTIFIED SOLUTION

oBdA

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

compdigit44

ASKER

We found when we simple select the group on the MFA tab for the relaying party and check both internal and external. It prompts for MFA but does it for everyone. If we remove the internal and external access check boxes, but leave the group, it does not prompt at all.

compdigit44

ASKER

I found by error, it was a typo