Following the documentation and @Velu's blog post on Access Management, we can see how to connect Access Management to Windows Authentication as an Identity Provider (IDP).

For any IDP, there are general settings but the documentation for Windows doesn't describe much about claims.


  1. Do claims (type and value) apply when using Windows as an IDP for Access Management?
  2. If so, how or where would you find the possible claims and values for a given organization?

For comparison, the documentation for LDAP offer CN or UID as example claims for username or full name. But it's hard to tell if there might be equivalents for Windows Authentication.

1 Answer 1


As with any Identity Provider, the easiest way to find out which claims are obtained is to open the Identity Provider in the Access Management UI and press the Validate button. This will check if the Identity Provider connection works and, if it does, it will show all the provided claims.

By default, the Windows IDP doesn't provide many claims except account name and full name. It is possible to let it provide claims for Windows Group memberships too in configuration.

  • Perfect. From the validate page can we copy and paste the claims? Seems almost too easy. :-) Commented Nov 5, 2021 at 16:28
  • We hope it is as easy as it seems to be. :-) Commented Nov 8, 2021 at 7:32
  • As a quick follow-up as an FYI for others, I've since seen at least the sub and name claims in a Windows IDP setup. There's also that flag in app.settings to expose the Windows claims to Access Management to see others. Very nice. Commented Mar 19 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.