How to get user groups from on-premise ADFS claims

Question

I have followed this article to build demo app with on-premise ADFS federation.

http://www.cloudidentity.com/blog/2014/02/12/use-the-on-premises-organizational-authentication-option-adfs-with-asp-net-in-visual-studio-2013/

I am able to get needed information for user using simple code

Dim UserEmail = System.Security.Claims.ClaimsPrincipal.Current.FindFirst(System.IdentityModel.Claims.ClaimTypes.Email).Value

But how I can get user groups where the username belongs and check if user account is member of Windows group in Active Directory?

I have tried to use System.Security.Claims.ClaimsPrincipal.Current.IsInRole to check if user is in group, but it won't work

Answer 1

With this is enough.

ClaimsPrincipal.Current.AddIdentity(new ClaimsIdentity());
ViewBag.Name = ClaimsPrincipal.Current.FindFirst(ClaimTypes.Email).Value;

:)

Answer 2

In ADFS claims rules, you need to configure a rule "Send LDAP Attributes as Claims" / "Token Groups - Unqualified Names" and map to "Role" as the "Outgoing Claim Type".

ADFS then provides all the security groups the user is memberOf in Role format and WIF maps them to the IsInRole construct.