title: Getting Group Claims With ADFS 4.0 OAuth2 Token
body: <p>I successfully set up an ADFS 4.0 instance (Windows Server 2016) which I intend to use to authenticate and authorize the users of a single-page application towards a WebApi. </p>
  
  <p>I pretty much followed this tutorial: <a href="https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/development/single-page-application-with-ad-fs" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/development/single-page-application-with-ad-fs</a> .. which is modifying a sample that uses Azure Active Directory.</p>
  
  <p>Now.. all seems to work fine, I can get a basic JWT token from the <code>/oauth2/authorize</code> endpoint:</p>
  
  <pre><code>{
    "aud": "d668d637-7fd4-45ef-9eab-46fee230dcbc",
    "iss": "https://fs.contoso.com/adfs",
    "iat": 1494341035,
    "exp": 1494344635,
    "auth_time": 1494341035,
    "nonce": "c91e3f78-c31a-402e-a685-8d1586915227",
    "sub": "Rl7sOj0nDbgh8BVWZegrkvgAKaB/SwNuEbmORcWcae4=",
    "upn": "john.doe@contoso.com",
    "unique_name": "CONTOSO\\JohnDoe"
  }
  </code></pre>
  
  <p>The token from AzureAD contained more properties, particularly <code>family_name</code> and <code>given_name</code>. But I was also hoping to add explicit group claims to the token. I thought I should be able to make this happen by setting the <em>'Issuance Transform Rules'</em> correctly in the Web application Properties ( Application Groups -> MyApp -> MyApp - WebApplication -> Properties). However, it seems no matter what I do, <strong>nothing seems to have any effect on the properties contained in the JWT returned from the endpoint</strong>. I always get exactly the same token structure. </p>
  
  <p><a href="https://i.stack.imgur.com/m1QN1.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/m1QN1.png" alt="Edit Rule Dialog"></a></p>
  
  <p>I am not really sure how the 'Outgoing Claims' map to the token properties  as nothing except the 'UPN' and the 'unique name' seems to be transferred. Any pointers what I may be doing wrong here?</p>