Enabling access policy in ADFS 4.0 for OpenID Connect clients

Question

AD FS supports OpenID Connect protocol for authenticating users. AD FS supports access policies for WebAPI applications, but not for server applications, at least not that I could find.

Is it possible to define access policy for a server application? The business scenario is really simple: only allow users from a defined group to authenticate given a specific client id.

If an enterprise deploys AD FS with AD DS and deploys several applications (each one registered separately, thus getting a unique client id and client secret), this could be used to allow/disallow users from authenticating to the ADFS for a given (registered) client (relying party).

Answer 1

It appears that this is possible by defining two applications in the same application group:

1. The server application, which has a client secret in addition to client id
2. The WebAPI application, for which you can define an access policy.

In order to make this work, you need to assign the relying party identifier (the client id of the server application) to the WebAPI identifiers and ensure that the "Client permissions" of the WebAPI application contain the server application.

If the access policy is not evaluated successfully, the relying party (the application requesting authentication) will receive an access_denied message.

Application group:

Server application:

WebAPI application: