DRAG DROP
Yournetwork contains two Active Directory forests named contoso.com and adatum.com. All
domain controllers run Windows Server 2012 R2.
A federated trust exists between adatum.com and contoso.com. The trust provides adatum.com
users with access to contoso.com resources.
Youneed to configure Active Directory Federation Services (AD FS) claim rules for the federated
trust.
The solution must meet the following requirements:
In contoso.com, replace an incoming claim type named Group with an outgoing claim type
named Role.
In adatum.com, allow users to receive their tokens for the relying party by using their Active
Directory group membership as the claim type.
The AD FS claim rules must use predefined templates.
Which rule types should you configure on each side of the federated trust?
To answer, drag the appropriate rule types to the correct location or locations. Each rule type may
be used once, more than once, or not at all. You may need to drag the split bar between panes or
scroll to view content.
Answer: 
Explanation:
<map><m x1=”1″ x2=”248″ y1=”66″ y2=”88″ ss=”0″ a=”0″ /><m x1=”2″ x2=”247″ y1=”101″
y2=”120″ ss=”0″ a=”0″ /><m x1=”4″ x2=”250″ y1=”134″ y2=”156″ ss=”0″ a=”0″ /><m x1=”2″
x2=”247″ y1=”168″ y2=”189″ ss=”0″ a=”0″ /><m x1=”440″ x2=”685″ y1=”65″ y2=”92″ ss=”1″ a=”0″
/><m x1=”438″ x2=”687″ y1=”102″ y2=”127″ ss=”1″ a=”0″ /><c start=”0″ stop=”0″ /><c start=”2″
stop=”1″ /></map>* Acceptance transform rule set
A set of claim rules that you use on a particular claims provider trust to specify the incoming claims
that will be accepted from the claims provider organization and the outgoing claims that will be
sent to the relying party trust.
Used on: Claims provider trusts
* Issuance Authorization Rule Set
A set of claim rules that you use on a relying party trust to specify the claims that will be issued to
the relying party.
Used on: Relying party trusts
The Role of Claim Rules
http://technet.microsoft.com/zh-cn/library/ee913586(v=WS.10).aspx
agree
claims provider trust: acceptance transform rule
relying party trust: issuance authorization rule
contoso = Resource partner = Relying party
adatum = Account partner = Claims provider
contoso contains the claims provider trust
adatum contains the relying party trust
Contoso
In my lab adfs the built-in claims provider trust called “Active Directory” has one rule tab “Acceptance Transform Rules”. If I click Add Rule, select the “Transform an Incoming Claim” template I get a form which has a field “Incoming claim type” where I can select Group from a drop down, and another field “Outgoing claim type” where I can select Role.
So this seems to match the requirement “In contoso.com, replace an incoming claim type named Group with an outgoing claim type named Role.”
Adatum
If I go to a relying party trust and click “Edit Claim Rules” there’s a template called “Send Group Membership as a Claim”, where you can specify the Group claim type, and the group name. You can use this template to create either an Issuance Authorization rule or an Issuance Transform rule, but we aren’t transforming anything so an Issuance Authorization rule seems to fit better.
7
0