Troubleshooting: Group Filter Expression Does Not Work for WS-Fed Integrations

Version Affected: All
 
 

Overview

SecureAuth IdP's Group Filter Expression setting lets an administrator filter which groups are sent for a realm. When this setting is used on a realm configured for a WS-Federation (WS-Fed) integration, no filtering takes place — every group is still sent.

 

Cause

This is expected behavior. The Group Filter Expression setting is not supported for WS-Fed integrations.

Resolution:

Use the Transformation Engine to filter groups for a WS-Fed integration instead. See How-To: Transformation Engine - Common XSLT Script Examples for worked examples of writing an XSLT script that filters groups before they're sent in the assertion.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.