Indexing of file shares is a common requirement if you have legacy file share that hasn't been migrated to SharePoint or you are using file share for archiving purposes. SharePoint Search can provide this functionality.
SharePoint also support search result trimming for file share content. That means that if the user does not have permission to a certain content on the file share, the user will not see the content appearing in the search results.
If you are using Windows integrated authentication the security trimming does not require anything special, it will just work. This is not the case if your users are using ADFS to authenticate against SharePoint. If you are using ADFS it is mandatory to have two more claims in order to make the security trimming working.
Those claims are Primary SID and Primary Group SID. In some articles you can find that the Primary SID is required in S2S authentication scenario, but nothing about the Primary Group SID. The Primary SID is the User object SID and the Primary Group SID is the SID of the Domain's primary group
In this post I will demonstrate how to setup it up in ADFS and SharePoint. I have tested it with ADFS 4.0 and SharePoint Server 2016.
On the ADFS side you will need to create two Issuance Transformation rules using template "Pass Through or Filter an Incoming Claim".
You can use below rules to append your rule file and import it to your SharePoint Relying Party Trust(s).
But first, you will have to export your current rules by using below command.
$sprp = Get-AdfsRelyingPartyTrust -Name "<SharePointRP_Name>" $sprp.IssuanceTransformRules | Out-File "C:\IssuanceTransformRules.txt"
Append the file with below rules for Primary SID and Primary Group SID or any additional rules you might want.
@RuleTemplate = "PassThroughClaims" @RuleName = "Pass Primary Group SID" c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid"] => issue(claim = c); @RuleTemplate = "PassThroughClaims" @RuleName = "Pass Primary SID" c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"] => issue(claim = c);
Now, import the file containing your old and newly added rules.
Set-AdfsRelyingPartyTrust -TargetName "<SharePointRP_Name>"` -IssuanceTransformRulesFile "C:\IssuanceTransformRules.txt"
On the SharePoint side you will have to create the claim type mappings for the two new claims. You can use the example script below.
Add-PSSnapin *SH* $sts = Get-SPTrustedIdentityTokenIssuer $sts.ClaimTypes.Add("http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid") $sts.ClaimTypes.Add("http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid") $sts.Update() $map = New-SPClaimTypeMapping ` -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid" ` -IncomingClaimTypeDisplayName "Primary group SID" -SameAsIncoming $map2 = New-SPClaimTypeMapping ` -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid" ` -IncomingClaimTypeDisplayName "Primary SID" -SameAsIncoming Add-SPClaimTypeMapping -Identity $map -TrustedIdentityTokenIssuer $sts Add-SPClaimTypeMapping -Identity $map2 -TrustedIdentityTokenIssuer $sts
And that's is all you need to do. If everything is fine you will see values for the two new claims and the security trimming should work for the ADFS users.
If you are wondering how to see the claims, I am using one of the many SharePoint Claims Viewer web parts found on the internet. I am also using LDAPCP for claims provider. Above requirement and scripts will be the same if you are using the OOTB claims provider.
I hope you found it helpful!
