Which two claim rules will be added to specify the claims sent from ADFS to Cisco Identity Service as part of a successful SAML assertion in PCCE? (Choose two.)

Question

Options

• AsAMAccountName Logon names maintained for backward compatibility
• Buser_principal For Identifying the authentication realm of the user in the assertion sent to Cisco
• CE-Mail Address For the Outgoing claim type
• DUnspecified For the Incoming name ID format
• Euid For Identifying the authenticated user in the claim sent to the applications

• A
  3% (1)
• B
  75% (24)
• C
  9% (3)
• D
  13% (4)

Explanation

In PCCE SAML SSO configuration, Cisco Identity Service requires exactly two custom claim rules from ADFS: user_principal (B) to communicate the authentication realm - typically mapped to the UPN attribute - so IdS knows which domain the user belongs to, and uid (E) to uniquely identify the authenticated user within the application assertion, which is how downstream Cisco contact center components recognize who is logged in.

Why the distractors are wrong:

• A (sAMAccountName) is a valid AD attribute but is not one of the two claim rules Cisco IdS expects by name in a PCCE SAML assertion.
• C (E-Mail Address) is not a required outgoing claim type for PCCE's Cisco IdS integration - email is not used to identify the user in this flow.
• D (Unspecified) refers to the incoming Name ID format setting, which is a format option, not a claim rule added to the assertion.

Memory tip: Think of the two claims as answering two questions Cisco IdS asks: "Where is this user from?" → user_principal (realm/UPN), and "Who specifically is this user?" → uid (identifier). "Realm and ID - that's all IdS needs."

No community discussion yet for this question.