Which two claim rules will be added to specify the claims sent from ADFS to Cisco Identity Service as part of a successful SAML assertion in PCCE?…

For integrating Cisco Identity Service (IdS) with Microsoft ADFS for Single Sign-On (SSO) in a PCCE environment, specific claim rules must be configured on the ADFS server for the Cisco IdS Relying Party Trust. According to official Cisco documentation, two key claims are required:

1. A claim that maps the user's email address from Active Directory. This is typically an outgoing claim of type E-Mail Address, which is then transformed into the SAML NameID.

2. A claim that uniquely identifies the user. The User Principal Name (UPN) from Active Directory is mapped to an outgoing claim type of uid.

These two claims, NameID (from email) and uid (from UPN), are essential for the SAML assertion to be successfully processed by the Cisco Identity Service.

A. sAMAccountName - Logon names maintained for backward compatibility: The standard configuration for Cisco IdS uses User Principal Name (UPN) and E-Mail Address as the source attributes from Active Directory, not the legacy sAMAccountName.

B. userprincipal - For Identifying the authentication realm of the user...: While User Principal Name (UPN) is the source attribute from Active Directory, the required outgoing claim type sent to Cisco IdS is 'uid', not 'userprincipal'. Option E is more precise.

D. Unspecified - For the Incoming name ID format: The "Unspecified" format is used for the outgoing Name ID claim that ADFS sends to Cisco IdS, not for an incoming Name ID format.

1. Security Guide for Cisco Unified CCE

Release 12.5(1)

Chapter: Single Sign-On

Section: "Configure SSO with ADFS 3.0 and 4.0"

Sub-section: "Add Relying Party Trust".

Page/Section Reference: In the procedure "Add Relying Party Trust"

Step 7 details the "Add Transform Claim Rule Wizard" configuration. It explicitly lists the rules to be created:

Rule 1 (Supports Option C): Maps the LDAP Attribute "E-Mail-Addresses" to the Outgoing Claim Type "E-Mail Address".

Rule 2: Transforms the "E-Mail Address" claim into the "Name ID" outgoing claim.

Rule 3 (Supports Option E): Maps the Incoming claim type "UPN" (sourced from the LDAP User-Principal-Name attribute) to the Outgoing Claim Type "uid". This guide is the primary source for this configuration.