How to determine claims and values for Access Management with Windows

Question

Following the documentation and @Velu's blog post on Access Management, we can see how to connect Access Management to Windows Authentication as an Identity Provider (IDP).

For any IDP, there are general settings but the documentation for Windows doesn't describe much about claims.

Questions:

1. Do claims (type and value) apply when using Windows as an IDP for Access Management?
2. If so, how or where would you find the possible claims and values for a given organization?

For comparison, the documentation for LDAP offer CN or UID as example claims for username or full name. But it's hard to tell if there might be equivalents for Windows Authentication.

Answer 1

As with any Identity Provider, the easiest way to find out which claims are obtained is to open the Identity Provider in the Access Management UI and press the Validate button. This will check if the Identity Provider connection works and, if it does, it will show all the provided claims.

By default, the Windows IDP doesn't provide many claims except account name and full name. It is possible to let it provide claims for Windows Group memberships too in configuration.