Claim Rules Engine

Claim rules can be defined for different organizational levels, namely Subscription level, Tenant level, Client Application level, and a combination of Client Applications and Idp Instances. So all the claim rules applicable for the current login process are evaluated.

All the resulting claim rules are grouped by their level, starting at 0. All the groups of the same level are executed in parallel and their results are combined as a level result. If multiple rules return the same claims (same type and value), only a single instance is returned as a level result. If the same claim has different claim targets, the claim targets are combined for this claim in the level results. The output of the preceding level is the input of the succeeding level. The last level result set is used as a basis to issue the tokens.

There are currently four types of claim rules:

• Filter Claim Rule

  A filter claim rule filters the the claims according to their type or value or a combination of both. Only claims which match the filter criteria will be forwarded to the result set.

  Filter type:

  • Filter claim type by regex
  • Filter claim value by regex
  • Filter claim type by regex and claim value by regex

• Transform Claim Rule

  A transformation claim rule modifies the type or value or both of a claim and forwards the modified claim to the results.

  • Match Criteria (same as filter, only matched claims are transformed)
    • Match claim type by regex
    • Match claim value by regex
    • Match claim type by regex and claim value by regex
  • Transform
    • Transform claim type by regex and replacement pattern
    • Transform claim value by regex and replacement pattern
    • Transform claim type and claim value by regex and replacement pattern

• Create Claim Rule

  The create claim rule creates an additional claim to the results.

  • Create Rule
    • Fixed value for type or value
    • Template variables (user properties)

• Conditional Create Claim Rule

  The conditional create claim rule creates an additional claim if the condition applies. If the condition is true from multiple claims, only a single new claim is created.

  • Match Criteria (same as filter, only if at least one match occurred, the new claim is created)
    • Match claim type by regex
    • Match claim value by regex
    • Match claim type by regex and claim value by regex
  • Create Rule
    • Fixed value for type or value
    • Template variables (user properties)