title: Explain ADFS claim rules
body: <p>I have many clients that uses SSO, for that we use SAML 2. Many of my clients uses providers like Okta, PingIdentity and a bunch of them ADFS. Doing the integration with ADFS always at the beginning raises and error, and then they fix this with the following setup on their side:</p>
  
  <p><strong>Transform Incoming Claim</strong></p>
  
  <ul>
  <li><p>Incoming claim = UPN   </p></li>
  <li><p>Outgoing Claim = Name ID</p></li>
  <li><p>Outgoing name ID format = Email</p></li>
  </ul>
  
  <p>The error that we saw on the saml reponse is that they do not send a nameID, instead we see this:</p>
  
  <pre><code>&lt;samlp:Status&gt;&lt;samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"&gt;&lt;samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/&gt;&lt;/samlp:StatusCode&gt;&lt;/samlp:Status&gt;
  </code></pre>
  
  <p>This is just happening with ADFS integrations, and I want to know what should I know about claim rules on ADFS in order to underestand this error and explain to my following clients that uses ADFS.</p>