Query AD Group to get Custom Attribute on it
<p>I am trying to get a Custom Attribute of a Group in Custom Claim rule.</p>

<p>The problem is no matter what i do, it always queries against User.</p>

<p>Here is how my Custom Claim Rule looks like:</p>

<p>//Rule to get all the Groups user is part of:</p>

<pre><code>c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
 =&gt; issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/claims/Group"), query = ";tokenGroups;{0}", param = c.Value);
</code></pre>

<p>//Rule to fetch url attribute that is on the Group.</p>

<pre><code>c:[Type == "http://schemas.xmlsoap.org/claims/Group"]
 =&gt; add(store = "Active Directory", types = ("http://temp/urlsOnGroup"), query = ";url;{0}", param = c.Value);
</code></pre>

<p>When this executes, i see an error in the event log on AD FS Server which states that it is trying to find User with GroupName.</p>

<p>How do i specify this Rule so that the last query happens against the Group Name instead of User</p>

<p>Error Message:</p>

<pre><code>Microsoft.IdentityServer.ClaimsPolicy.Language.PolicyEvaluationException: 
POLICY0018: Query ';url;{0}' to attribute store 'Active Directory' failed: 
'POLICY3826: User name 'GroupName' in LDAP query ';url;GroupName' is not in the 
required 'domain\user' format. POLICY3824: The LDAP query to the Active 
Directory attribute store must have three parts separated by semicolons. The 
first part is the LDAP query filter, the second part is a comma-separated list 
of LDAP attribute names, and the third part is the user name in 'domain\user' 
format.'. ---&gt; 
Microsoft.IdentityServer.ClaimsPolicy.Engine.AttributeStore.AttributeStoreQueryF
ormatException: POLICY3826: User name 'GroupName' in LDAP query ';url;GroupName' 
is not in the required 'domain\user' format. POLICY3824: The LDAP query to the 
Active Directory attribute store must have three parts separated by semicolons. 
The first part is the LDAP query filter, the second part is a comma-separated 
list of LDAP attribute names, and the third part is the user name in 
'domain\user' format.
</code></pre>

<p>I want to avoid writing <code>Custom Attribute Store</code> if possible. I have already did that but i am trying to find native way to query agains AD Security Groups.</p>