azure-active-directory - Does CloudFoundry UAA support graph endpoints for group claim information?

Question

We use CloudFoundry UAA for our applications authentication system. We use Microsoft Azure AD as the Identity Provider.

We've run across an issue where users with over 150 AD groups stop getting their groups passed in the SAML token due to Microsoft having a 150 AD group limitation in Azure (We're also ensuring we only send SecurityGroups in the claims info.) Microsoft converts the group claims to a graph endpoint in the SAML token if a user has over 150 AD groups. Microsofts term for this is "overage claim". Our UAA does not appear to know how to handle graph endpoints or "overage claims".

Does UAA support SAML graph endpoints for group claims information? We use this to auto map users from their AD groups to our UAA groups and it's critical to get this working. For now we manually add our UAA groups to our users Shadow profiles as a workaround.

I cannot find information on if UAA supports this and how to enable it.

标签： azure-active-directorycloudfoundry-uaa

Answer 1

截至本回复之日，UAA 不支持图形端点。Pivotal 现在已将该功能输入到他们的跟踪器中。交货时没有预计到达时间。

对于变通解决方案，您可以使用 AD 角色。如本指南所述： https ://joonasw.net/view/using-groups-vs-using-app-roles-in-azure-ad-apps

跟踪器参考： https ://www.pivotaltracker.com/n/projects/997278/stories/168080479

Git问题： https ://github.com/cloudfoundry/uaa/issues/1082