Configuring the claim issuance policy

Last Updated : Jun 10, 2026 |

About this task

AD FS issues tokens that contain set of claims. You must configure the claim issuance policy so that AD FS passes correct claims to Keycloak and receives correct claims from Keycloak.

Procedure

  1. Log in to the AD FS Manager as an administrator.
  2. Navigate to Relying Party Trust.
  3. Right click on the relying party that you created for Keycloak and then select Edit Claim Issuance Policy from the menu.
  4. Click Add Rule and add a new rule with the following parameters:
    1. In Rule template, select Send LDAP Attributes as Claim.
    2. In Claim rule name, type a name of your choice for the rule.
    3. In Attribute store, select Active Directory.
    4. Configure the mapping of LDAP attributes to outgoing claim types as in the following table:

      LDAP Attribute

      Outgoing Claim Type

      Given-Name

      Given Name

      Surname

      Surname

      E-Mail-Addresses

      E-Mail Address
  5. Click Add Rule and add a new rule with the following parameters:
    1. In Rule template, select Transform an Incoming Claim.
    2. In Claim rule name, type Name ID.
    3. In Incoming claim type, select E-Mail Address.
    4. In Outgoing claim type, select Name ID.
    5. In Outgoing name ID format, select Email.
    6. Select Pass through all claim values.
  6. Click Add Rule and add a new rule with the following parameters:
    1. In Rule template, select Send Group Membership as a Claim.
    2. In Claim rule name, type Group: user.
    3. In User's group, select a group with users who must use SSO capabilities from your active directory.
    4. In Outgoing claim type, select Group.
    5. In Outgoing claim value, select user.
  7. Click Add Rule and add a new rule with the following parameters:
    1. In Rule template, select Send Group Membership as a Claim.
    2. In Claim rule name, type Group: admin.
    3. In User's group, select a group with administrative users from your active directory.
    4. In Outgoing claim type, select Group.
    5. In Outgoing claim value, select admin.