By default, claim type objects are protected from accidental deletion. This option prohibits all users, including domain and enterprise administrators, from deleting the claim type object. Protection is achieved by adding an explicit permission entry to the claim type object that denies everyone the right to delete the object. When you create a claim type object, the option to protect the object from accidental deletion is selected by default. As a best practice, it is advisable to leave this option selected.
The suggested values setting allows you to configure predefined values from which you can choose when using the claim type in a conditional expression. If you create a claim type without suggested values, you will have to type rather than select values in the condition builder. Another option is to create one or more suggested values for the claim type. These values will appear in a list provided by the condition builder.
You can add, edit or remove suggested values for a given claim type when creating or modifying the respective claim type object. When you add or edit a suggested value, you are prompted to complete the following fields:
Claim types must be created in Active Directory to enable domain controllers to issue claims to users or computers. Claims issued by the domain controller are sourced from attributes of user or computer accounts stored in Active Directory. Claim types specify the attributes from which the claims are sourced, and contain metadata required for using claims.
New claim types are created in the Claim Types container under the Active Directory node located in the Active Roles console tree. If you have domains from multiple forests registered with Active Roles, then the console displays an individual Claim Types container for each forest that has domain controllers running Windows Server 2012 or a later version of the Windows Server operating system. To identify the forest of a given Claim Types container, the container’s name includes the name (or a part of the name) of the forest root domain.
To create a new claim type
To modify an existing claim type
To delete a claim type
If you encounter a message stating that you don’t have permission to delete the claim type, then modify the claim type and clear the Protect from accidental deletion check box. If this check box is cleared, verify that you have sufficient rights to delete claim type objects.
Windows claim types have two states: disabled and enabled. Disabled claim types are valid claim types, but are unavailable for use in production. Claims of disabled claim types are not issued by domain controllers and disabled claim types are filtered from view in the access rule condition builder. A claim type becomes available for production use once you enable it. Active Roles creates enabled claim types, and allows you to disable and enable claim types as needed.
To disable an enabled claim type
To enable a disabled claim type