So now that we have seen high level overview of the claims picker, let’s focus on how the claims enrichment is done.

First thing to know, when you create a custom claim provider you actually derive a class from SPClaimProvider and then you specify what your claim provider is supporting by overriding the following methods:

public override bool SupportsEntityInformation
  {
      get
      {
          return true;
      }
  }

  public override bool SupportsHierarchy
  {
      get
      {
          return true;
      }
  }

  public override bool SupportsResolve
  {
      get
      {
          return true;
      }
  }

  public override bool SupportsSearch
  {
      get
      {
          return true;
      }
  }

This code basically says that our custom claims provider allow users to search for claims, support hierarchy (meaning that it displays a tree in the picker – cf. Post http://www.pascalbonheur.com/2010/04/claims-based-authorization-in-sharepoint-2010-real-life-example-part-2/) and also support resolution.

Next thing that we want to code is the actual claims enrichment, ie. the place where the claims are actually added to the current user depending on who is logged in into the system.

This code is implemented in the FillClaimsForEntity method that has the following signature :

protected override void FillClaimsForEntity(Uri context, SPClaim entity, List<SPClaim> claims)

In this method, in our case (claims coming from a SQL Database), we create a connection to a SQL Database to get the current year of the current user. In order to do that, we get the current user login from one of the claim (could be retrieve with the usual SPContext.Current.Web.CurrentUser…) and call the database.

//here, entity is the current Claim (cf. method FillClaimsForEntityDefinition)

string currentUser = entity.Value.Substring(entity.Value.IndexOf("|") + 1);

string currentYear = DAL.GetCurrentYear(currentUser);

Then the key is to add the claim to the claims collection so that the user is now enriched with this claim.

claims.Add(CreateClaim(“http://schema.DEMO.local/year”,currentYear,Microsoft.IdentityModel.Claims.ClaimValueTypes.String);

Now the user has the appropriate claim for his current Year. It means that if we give access to a SharePoint list for all the students of 2006, users will have access to this list if they are in this year in the SQL database.

In the next post on this serie, I will cover the claim resolution.