1. Home
    2. Security Operations
    3. Cortex XSOAR
    4. Cortex XSOAR Administrator’s Guide
    5. Users and Roles
    6. Authenticate Users with SAML 2.0
    7. Set up ADFS as the Identity Provider Using SAML 2.0
    8. Create Relying Party Trust in ADFS
    9. Define the Claim Issuance Policy
    End-of-Life (EoL)

    Define the Claim Issuance Policy

    You need to define the claim issuance policy. Before you start you need to create the Relying Party Trusts as described in Create Relying Party Trust in ADFS.
    1. From the right menu pane of the Relying Party Trusts, click
      Edit Claim Issuance Policy
    2. Click
      Add Rule
      .
    3. In the Add Transform Claim Rule Wizard, select
      Transform an Incoming Claim
       from the drop down list.
    4. Click
      Next
      .
    5. In the Configure Claim Rule page, type the Claim rule name
      WindowsAccountName
       which will pass the user login name in AD and select the Windows account name for the Incoming and Outgoing claim type.
    6. Click
      Finish
      .
    7. Add another claim rule which will pass the AD user account attributes to Cortex XSOAR. This step is required to map the user group membership, full name, email, phone and other LDAP attributes.
      1. From the right menu pane of the Relying Party Trusts, click
        Edit Claim Issuance Policy
      2. Click
        Add Rule
        .
      3. In the Add Transform Claim Rule Wizard, select
        Send LDAP Attributes as Claims
        from the drop down list.
      4. Click
        Next
        .
      5. In the Configure Claim Rule page, type a claim rule name, select Active Directory from the Attribute store drop down list and map the required fields. Note that the user group attribute is mandatory if you wish to map the user group to the Cortex XSOAR user role.
      6. Click
        Finish
         and then click
        OK
         to create the claim rules.
    8. Open PowerShell and make sure the IDP Sign-on page is enabled
      If one of these setting are set to false, enable it by typing
      Set-AdfsProperties -<Property Name RelayState or EnableIdp> $True
    9. Verify that the ADFS IDP Sign-on page is working by browsing to the ADFS service portal URL, in our example: https://demistodev.local/adfs/ls/idpinitiatedsignon.aspx

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2022 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo