WS-Federation Confusion

PowerShell Universal
1 
Product: PowerShell Universal
Version: 1.4.6

I am not understanding how I set up the claims.

I am authenticating using SSO but I want it to assign to my custom roles and I don’t understand where the policies are updated.

I have 2 roles created
Admins - Admins Security Group
Users = Users Security Group

I just want users to see pages or dashboards and that’s it Admins see everything.
I am just lost on this part

Help on this is appreciated.

2

You need to setup the policy script to check the claims of the user logging in. Here’s an example of how to do so with Active Directory. It will be similar to WS-Fed: https://docs.powershelluniversal.com/config/security#example-policy-based-on-active-directory-group-membership-windows-authentication

3

So I added the following to roles.ps1 and it’s still defaulting to Policy Defined for my non-admin users.
Should it be displaying the roles I created for the user or continue to use Policy Defined?

New-PSURole -Name "Admins" -Policy {
param($User)

$User.HasClaim("http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", 'S-1-5-21-2455101938-2081098319-3243300316-1067472')

$true
} 
New-PSURole -Name "Users" -Policy {
param(
$User
)
$User.HasClaim("http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", 'S-1-5-21-2455101938-2081098319-3243300316-1067593')

$true
}
4

It will continue to show Policy Defined in the dashboard. The user’s role will be determined upon login. If you assign a role in the identities page, that is static and it won’t run the policy.

5

So I tested my policy and I am getting a null returned in my JSON file

$User | ConvertTo-Json | Out-File .\myAdmins.json

When i set authentication on a page it breaks and i get 404 error.

6

The entire JSON file is empty when you do this?

7

No it says null

8

Ok. I’m going to open an issue to track this because I need to setup WS-Fed to verify that I’m not missing something here.

That variable should never be null in roles.ps1

9

I forgot to mention this happened in version 2.5.3 I am going to revert to 2.5.2 and see what happens

10

I am still having this issue, I stepped away from the project due to other priorities, but I am not seeing the file created when I use it.

I have my claims set up as well. Is there something I am missing

2023-03-10_10-32-26

$User | ConvertTo-Json | Out-File .\myAdmins.json
11

so I tried the following instead of using the form.


param(
[Security.ClaimsPrincipal]$User
)
$User.HasClaim("http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", 'S-1-5-21-2455101938-2081098319-3243300316-1067593')

$true
$User | ConvertTo-Json | Out-File .\myAdmins.json

These are my results.

{
  "Claims": [
    {
      "Type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
      "Value": "OJR2",
      "ValueType": "http://www.w3.org/2001/XMLSchema#string",
      "Issuer": "http://3dsfederation.3ds.com/adfs/services/trust",
      "Properties": ""
    },
    {
      "Type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
      "Value": "OJR2",
      "ValueType": "http://www.w3.org/2001/XMLSchema#string",
      "Issuer": "http://3dsfederation.3ds.com/adfs/services/trust",
      "Properties": ""
    },
    {
      "Type": "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod",
      "Value": "urn:federation:authentication:windows",
      "ValueType": "http://www.w3.org/2001/XMLSchema#string",
      "Issuer": "http://3dsfederation.3ds.com/adfs/services/trust",
      "Properties": ""
    },
    {
      "Type": "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant",
      "Value": "2023-03-14T13:17:51.375Z",
      "ValueType": "http://www.w3.org/2001/XMLSchema#dateTime",
      "Issuer": "http://3dsfederation.3ds.com/adfs/services/trust",
      "Properties": ""
    },
    {
      "Type": "http://schemas.microsoft.com/ws/2008/06/identity/claims/role",
      "Value": "Execute",
      "ValueType": "http://www.w3.org/2001/XMLSchema#string",
      "Issuer": "https://www.poshtools.com",
      "Properties": ""
    },
    {
      "Type": "http://schemas.microsoft.com/ws/2008/06/identity/claims/role",
      "Value": "Reader",
      "ValueType": "http://www.w3.org/2001/XMLSchema#string",
      "Issuer": "https://www.poshtools.com",
      "Properties": ""
    },
    {
      "Type": "http://schemas.microsoft.com/ws/2008/06/identity/claims/role",
      "Value": "Operator",
      "ValueType": "http://www.w3.org/2001/XMLSchema#string",
      "Issuer": "https://www.poshtools.com",
      "Properties": ""
    },
    {
      "Type": "RolesAssigned",
      "Value": "true",
      "ValueType": "http://www.w3.org/2001/XMLSchema#string",
      "Issuer": "https://www.poshtools.com",
      "Properties": ""
    }
  ],
  "Identity": {
    "Name": "OJR2"
  }
}