Set-ADFSClaimsProviderTrust

  • Article

Set-ADFSClaimsProviderTrust

Sets the properties of a claims provider trust.

Syntax

Set-ADFSClaimsProviderTrust [-TargetName] <string[]> [-AcceptanceTransformRules <string>] [-AcceptanceTransformRulesFile <string>] [-AllowCreate <System.Nullable[bool]>] [-AutoUpdateEnabled <Boolean>] [-ClaimOffered <ClaimDescription[]>] [-EncryptionCertificate <X509Certificate2>] [-EncryptionCertificateRevocationCheck <string>] [-Identifier <string>] [-MetadataUrl <Uri>] [-MonitoringEnabled <Boolean>] [-Name <string>] [-Notes <string>] [-PassThru] [-ProtocolProfile <string>] [-RequiredNameIdFormat <Uri>] [-RequiresEncryptedNameId <System.Nullable[bool]>] [-SamlAuthenticationRequestIndex <int>] [-SamlAuthenticationRequestParameters <string>] [-SamlAuthenticationRequestProtocolBinding <string>] [-SamlEndpoint <SamlEndpoint[]>] [-SignatureAlgorithm <string>] [-SignedSamlRequestsRequired <System.Nullable[bool]>] [-SigningCertificateRevocationCheck <string>] [-TokenSigningCertificate <X509Certificate2[]>] [-WSFedEndpoint <Uri>] [-Confirm] [-WhatIf] [<CommonParameters>]

  • TargetName

  • AcceptanceTransformRules

  • AcceptanceTransformRulesFile

  • AllowCreate

  • AutoUpdateEnabled

  • ClaimOffered

  • EncryptionCertificate

  • EncryptionCertificateRevocationCheck

  • Identifier

  • MetadataUrl

  • MonitoringEnabled

  • Name

  • Notes

  • PassThru

  • ProtocolProfile

  • RequiredNameIdFormat

  • RequiresEncryptedNameId

  • SamlAuthenticationRequestIndex

  • SamlAuthenticationRequestParameters

  • SamlAuthenticationRequestProtocolBinding

  • SamlEndpoint

  • SignatureAlgorithm

  • SignedSamlRequestsRequired

  • SigningCertificateRevocationCheck

  • TokenSigningCertificate

  • WSFedEndpoint

  • Confirm

  • WhatIf

    Set-ADFSClaimsProviderTrust [-TargetIdentityProvider] <IdentityProvider[]> [-AcceptanceTransformRules ] [-AcceptanceTransformRulesFile ] [-AllowCreate <System.Nullable[bool]>] [-AutoUpdateEnabled ] [-ClaimOffered <ClaimDescription[]>] [-EncryptionCertificate ] [-EncryptionCertificateRevocationCheck ] [-Identifier ] [-MetadataUrl ] [-MonitoringEnabled ] [-Name ] [-Notes ] [-PassThru] [-ProtocolProfile ] [-RequiredNameIdFormat ] [-RequiresEncryptedNameId <System.Nullable[bool]>] [-SamlAuthenticationRequestIndex ] [-SamlAuthenticationRequestParameters ] [-SamlAuthenticationRequestProtocolBinding ] [-SamlEndpoint <SamlEndpoint[]>] [-SignatureAlgorithm ] [-SignedSamlRequestsRequired <System.Nullable[bool]>] [-SigningCertificateRevocationCheck ] [-TokenSigningCertificate <X509Certificate2[]>] [-WSFedEndpoint ] [-Confirm] [-WhatIf] []

  • TargetIdentityProvider

  • AcceptanceTransformRules

  • AcceptanceTransformRulesFile

  • AllowCreate

  • AutoUpdateEnabled

  • ClaimOffered

  • EncryptionCertificate

  • EncryptionCertificateRevocationCheck

  • Identifier

  • MetadataUrl

  • MonitoringEnabled

  • Name

  • Notes

  • PassThru

  • ProtocolProfile

  • RequiredNameIdFormat

  • RequiresEncryptedNameId

  • SamlAuthenticationRequestIndex

  • SamlAuthenticationRequestParameters

  • SamlAuthenticationRequestProtocolBinding

  • SamlEndpoint

  • SignatureAlgorithm

  • SignedSamlRequestsRequired

  • SigningCertificateRevocationCheck

  • TokenSigningCertificate

  • WSFedEndpoint

  • Confirm

  • WhatIf

    Set-ADFSClaimsProviderTrust [-TargetIdentifier] <Uri[]> [-AcceptanceTransformRules ] [-AcceptanceTransformRulesFile ] [-AllowCreate <System.Nullable[bool]>] [-AutoUpdateEnabled ] [-ClaimOffered <ClaimDescription[]>] [-EncryptionCertificate ] [-EncryptionCertificateRevocationCheck ] [-Identifier ] [-MetadataUrl ] [-MonitoringEnabled ] [-Name ] [-Notes ] [-PassThru] [-ProtocolProfile ] [-RequiredNameIdFormat ] [-RequiresEncryptedNameId <System.Nullable[bool]>] [-SamlAuthenticationRequestIndex ] [-SamlAuthenticationRequestParameters ] [-SamlAuthenticationRequestProtocolBinding ] [-SamlEndpoint <SamlEndpoint[]>] [-SignatureAlgorithm ] [-SignedSamlRequestsRequired <System.Nullable[bool]>] [-SigningCertificateRevocationCheck ] [-TokenSigningCertificate <X509Certificate2[]>] [-WSFedEndpoint ] [-Confirm] [-WhatIf] []

  • TargetIdentifier

  • AcceptanceTransformRules

  • AcceptanceTransformRulesFile

  • AllowCreate

  • AutoUpdateEnabled

  • ClaimOffered

  • EncryptionCertificate

  • EncryptionCertificateRevocationCheck

  • Identifier

  • MetadataUrl

  • MonitoringEnabled

  • Name

  • Notes

  • PassThru

  • ProtocolProfile

  • RequiredNameIdFormat

  • RequiresEncryptedNameId

  • SamlAuthenticationRequestIndex

  • SamlAuthenticationRequestParameters

  • SamlAuthenticationRequestProtocolBinding

  • SamlEndpoint

  • SignatureAlgorithm

  • SignedSamlRequestsRequired

  • SigningCertificateRevocationCheck

  • TokenSigningCertificate

  • WSFedEndpoint

  • Confirm

  • WhatIf

    Set-ADFSClaimsProviderTrust [-TargetCertificate] <X509Certificate2[]> [-AcceptanceTransformRules ] [-AcceptanceTransformRulesFile ] [-AllowCreate <System.Nullable[bool]>] [-AutoUpdateEnabled ] [-ClaimOffered <ClaimDescription[]>] [-EncryptionCertificate ] [-Identifier ] [-MetadataUrl ] [-MonitoringEnabled ] [-Name ] [-Notes ] [-PassThru] [-ProtocolProfile ] [-RequiredNameIdFormat ] [-RequiresEncryptedNameId <System.Nullable[bool]>] [-SamlAuthenticationRequestIndex ] [-SamlAuthenticationRequestParameters ] [-SamlAuthenticationRequestProtocolBinding ] [-SamlEndpoint <SamlEndpoint[]>] [-SignatureAlgorithm ] [-SignedSamlRequestsRequired <System.Nullable[bool]>] [-SigningCertificateRevocationCheck ] [-TokenSigningCertificate <X509Certificate2[]>] [-WSFedEndpoint ] [-Confirm] [-WhatIf] []

  • TargetCertificate

  • AcceptanceTransformRules

  • AcceptanceTransformRulesFile

  • AllowCreate

  • AutoUpdateEnabled

  • ClaimOffered

  • EncryptionCertificate

  • Identifier

  • MetadataUrl

  • MonitoringEnabled

  • Name

  • Notes

  • PassThru

  • ProtocolProfile

  • RequiredNameIdFormat

  • RequiresEncryptedNameId

  • SamlAuthenticationRequestIndex

  • SamlAuthenticationRequestParameters

  • SamlAuthenticationRequestProtocolBinding

  • SamlEndpoint

  • SignatureAlgorithm

  • SignedSamlRequestsRequired

  • SigningCertificateRevocationCheck

  • TokenSigningCertificate

  • WSFedEndpoint

  • Confirm

  • WhatIf

Detailed Description

The Set-ADFSClaimsProviderTrust cmdlet configures the trust relationship with a claims provider.

Parameters

AcceptanceTransformRules

Specifies the claim acceptance transform rules for accepting claims from this claims provider.

Default Value: **

Data Type: string

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

AcceptanceTransformRulesFile

Specifies a file that contains the claim acceptance transform rules for accepting claims from this claims provider.

Default Value: **

Data Type: string

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

AllowCreate

Specifies whether the SAML parameter AllowCreate should be sent in SAML requests to the claims provider. By default, this parameter is true.

Default Value: **

Data Type: System.Nullable[bool]

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

AutoUpdateEnabled

Specifies whether changes to the federation metadata at the MetadataURL that is being monitored are automatically applied to the configuration of the trust relationship. Partner claims, certificates, and endpoints are updated automatically if this parameter is enabled (true).
Note: When auto-update is enabled, fields that can be overwritten by metadata become read only.

Default Value: **

Data Type: Boolean

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

ClaimOffered

Specifies the claims that are offered by this claims provider.

Default Value: **

Data Type: ClaimDescription[]

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

true

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

true (ByValue)

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

true

variableLength

EncryptionCertificate

Specifies the certificate to be used for encrypting a NameID to this claims provider in SAML logout requests. Encrypting the NameID is optional.

Default Value: **

Data Type: X509Certificate2

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

EncryptionCertificateRevocationCheck

Name Value

Aliases

none

Required?

false

Position?

named

Default Value

none

Accept Pipeline Input?

false

Accept Wildcard Characters?

false

Identifier

Specifies the unique identifier for this claims provider trust. No other trust may use an identifier from this list. Uniform Resource Identifiers (URIs) are often used as unique identifiers for a claims provider trust, but any string of characters may be used.

Default Value: **

Data Type: string

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

MetadataUrl

Specifies the URL at which the federation metadata for this claims provider trust is available.

Default Value: **

Data Type: Uri

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

MonitoringEnabled

Specifies whether periodic monitoring of this claims provider's federation metadata is enabled. The URL of the claims provider's federation metadata is specified by the MetadataUrl parameter.

Default Value: **

Data Type: Boolean

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

Name

Specifies the friendly name of this claims provider trust.

Default Value: **

Data Type: string

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

Notes

Specifies any notes for this claims provider trust.

Default Value: **

Data Type: string

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

PassThru

Passes an object to the pipeline. By default, this cmdlet does not generate any output.

Default Value: **

Data Type: SwitchParameter

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

ProtocolProfile

This parameter controls which protocol profiles the claims provider supports. The protocol an be one of the following: {SAML, WsFederation, WsFed-SAML}. The default is WsFed-SAML, which indicates that both protocols are supported.

Default Value: **

Data Type: string

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

RequiredNameIdFormat

Specifies the format that is required for NameID claims to be included in SAML requests to the claims provider. By default, no format is required.

Default Value: **

Data Type: Uri

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

RequiresEncryptedNameId

Specifies whether this claims provider requires the NameID claim to be encrypted in SAML logout requests.

Default Value: **

Data Type: System.Nullable[bool]

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

SamlAuthenticationRequestIndex

Specifies the value of AssertionConsumerServiceIndex that will be placed in SAML authentication requests that are sent to the claims provider.

Default Value: **

Data Type: int

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

SamlAuthenticationRequestParameters

Specifies which of the parameters (AssertionConsumerServiceIndex, AssertitionConsumerServiceUrl, ProtocolBinding) will be used in SAML authentication requests to the claims provider. Specify a value from the following set: {None, Index, Url, ProtocolBinding, UrlWithProtocolBinding}.

Default Value: **

Data Type: string

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

SamlAuthenticationRequestProtocolBinding

Specifies the value of ProtocolBinding that will be placed in SAML authentication requests to the claims provider. Use values from the following set: {Artifact, Post, Redirect}.

Default Value: **

Data Type: string

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

SamlEndpoint

Specifies the SAML protocol endpoints for this claims provider.

Default Value: **

Data Type: SamlEndpoint[]

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

true

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

true (ByValue)

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

true

variableLength

SignatureAlgorithm

Specifies the signature algorithm that the claims provider uses for signing and verification. Valid values are as follows:
https://www.w3.org/2000/09/xmldsig\#rsa-sha1
https://www.w3.org/2001/04/xmldsig-more\#rsa-sha256

Default Value: **

Data Type: string

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

SignedSamlRequestsRequired

Specifies whether signed SAML protocol requests are required for this claims provider. When the value of this parameter is true, all SAML protocol requests to this claims provider will be signed.

Default Value: **

Data Type: System.Nullable[bool]

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

SigningCertificateRevocationCheck

Specifies the type of certificate validation that should occur when signatures are verified on responses or assertions from the claims provider. Valid values are None, CheckEndCert, CheckEndCertCacheOnly, CheckChain, CheckChainCacheOnly, CheckChainExcludeRoot, and CheckChainExcludeRootCacheOnly.

Default Value: **

Data Type: string

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

TargetCertificate

Specifies the certificate of the claims provider trust that will be modified by the cmdlet.

Default Value: **

Data Type: X509Certificate2[]

Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

true

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

true (ByValue)

pipelineInput

Position?

1

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

true

variableLength

TargetIdentifier

Specifies the identifier of the claims provider trust that will be modified by the cmdlet.

Default Value: **

Data Type: Uri[]

Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

true

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

true (ByValue)

pipelineInput

Position?

1

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

true

variableLength

TargetIdentityProvider

Specifies the claims provider trust that will be modified by the cmdlet. This value is typically taken from the pipeline.

Default Value: **

Data Type: IdentityProvider[]

Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

true

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

true (ByValue)

pipelineInput

Position?

1

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

true

variableLength

TargetName

Specifies the friendly name of the claims provider trust that will be modified by the cmdlet.

Default Value: **

Data Type: string[]

Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

true

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

true (ByValue)

pipelineInput

Position?

1

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

true

variableLength

TokenSigningCertificate

Specifies the token-signing certificates that the claims provider uses.

Default Value: **

Data Type: X509Certificate2[]

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

true

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

true

variableLength

WSFedEndpoint

Specifies the WS-Federation Passive URL for this claims provider.

Default Value: **

Data Type: Uri

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

true

required

Variable Length?

false

variableLength

Confirm

Prompts you for confirmation before executing the command.

Default Value: **

Data Type: SwitchParameter

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

true

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

WhatIf

Describes what would happen if you executed the command without actually executing the command.

Default Value: **

Data Type: SwitchParameter

Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

true

variableLength

Accept wildcard characters?

false

globbing

Accept Pipeline Input?

false

pipelineInput

Position?

named

position

Value Attributes

Name Value PSMAML Attribute

Required?

false

required

Variable Length?

false

variableLength

Input Type

Microsoft.IdentityServer.PowerShell.Resources.ClaimsProviderTrust

A class structure that represents a claims provider trust.

Return Type

None

Notes

  • The claims provider collects and authenticates a user's credentials, builds up claims for that user, and packages the claims into security tokens. In other words, a claims provider represents the organization for whose users the claims provider issues security tokens on their behalf. When you configure Active Directory Federation Services (AD FS) 2.0, the role of the claims provider is to enable its users to access resources that are hosted in a relying party organization by establishing one side of a federation trust relationship. After the trust is established, tokens can be presented to a relying party across the federation trust.

Examples

-------------------------- EXAMPLE 1 --------------------------

Command Prompt: C:\PS>

 
Set-ADFSClaimsProviderTrust -TargetName "My claims provider" -AutoUpdateEnabled $false

Description

-----------

Enables auto-update for the claims provider trust.

See Also

Reference

Get-ADFSClaimsProviderTrust
Remove-ADFSClaimsProviderTrust
Enable-ADFSClaimsProviderTrust
Disable-ADFSClaimsProviderTrust
Update-ADFSClaimsProviderTrust

Other Resources

Online version: