Views:
  1. Create Smart Check Admin group on Active Directory and add users to the group.
    Note that in this example "SmartCheck-Admin" as group name is used. You may change this to any name but make sure to change the value on Step 2.C as well.

    Module state

  2. Create Claim Rules.
    Under AD FS Management console > Trust Relationships > Relying Party Trust, right-click smartcheck then select "Edit Claim Rules...". Under "Issuance Transform Rules" tab click Add Rule... then create the following Claim Rules:
    1. RoleSessionName
      Enter the following:
      Claim Rule TemplateSend LDAP Attributes as Claim
      Claim Rules NameRoleSessionName
      Attribute StoreActive Directoy
      LDAP AttributeDisplay-Name
      Outgoing Claim Typehttps://deepsecurity.trendmicro.com/SAML/Attributes/RoleSessionName

      Module state

    2. Extract AD Group.
      Claim Rule templateSend Claims Using a custom rule
      Claim rule nameGet AD Groups
      Custom rulec:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
       => add(store = "Active Directory", types = ("http://schemas.microsoft.com/ws/2008/06/identity/claims/role"), query = ";tokenGroups;{0}", param = c.Value);

      Module state

    3. Map AD group to Smart Check role.
      Below is where you can change the AD Group. "SmartCheck-Admin" is used in this example. You can also change the Smart Check roles. The default roles are "administrator", "auditor", and "user".
      Claim Rule templateSend Claims Using a custom rule
      Claim rule nameRoles
      Custom ruleEXISTS([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/role", Value == "SmartCheck-Admin"])
       => issue(Type = "https://deepsecurity.trendmicro.com/SAML/Attributes/Role", Value = "administrator");

      Module state

    4. Set SAML assertion.
      Claim Rule TemplateTransform an Incoming Claim
      Claim Rules NameTransform
      Incoming Claim TypeWindows account name
      Outgoing Claim TypeName ID
      Outgoing name ID formatPersistent Identifier
      Radio buttonPass trough all claim values

      Module state

      Claim rules output:

      Module state

  3. Login using ADFS URL https://[ADFS-server hostname]/adfs/ls/IdpInitiatedSignon.aspx.
Keywords: Deep Security ADFS claim rules, Deep Security Smart Check SAML integration rules