0

I've created a azure login like discriped here: https://labs.tadigital.com/index.php/2018/02/16/integrating-federated-authentication-for-sitecore-9-with-azure-ad/

I am using Sitecore 9 Update 2.

the authentication works I think, because I got logged in. But I am using this transformation like descriped in the post to asign the current logged in user to the developer role

        <transformation name="devRole" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
          <sources hint="raw:AddSource">
            <claim name="groups" value="99c44f22-e2e2-4d2d-af90-3ccb0fb3b234" />
          </sources>
          <targets hint="raw:AddTarget">
            <claim name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" value="sitecore\Developer" />
          </targets>
          <keepSource>true</keepSource>
        </transformation>

but I am not assigned to any role and my username is just some random string

enter image description here

I was hopeing that this config section would take care about my username mapping, but that seems not to work.

<propertyInitializer type="Sitecore.Owin.Authentication.Services.PropertyInitializer, Sitecore.Owin.Authentication">
    <maps hint="list">
      <map name="email claim" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
        <data hint="raw:AddData">
          <!--claim name-->
          <source name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
          <!--property name-->
          <target name="Email" />
        </data>
      </map>
      <map name="Name claim" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
        <data hint="raw:AddData">
          <!--claim name-->
          <source name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" />
          <!--property name-->
          <target name="Name" />
        </data>
      </map>
    </maps>
  </propertyInitializer>

here is my Processing function for the backend

  protected override void ProcessCore(IdentityProvidersArgs args)
    {
        Assert.ArgumentNotNull(args, nameof(args));

        var identityProvider = this.GetIdentityProvider();
        var authenticationType = this.GetAuthenticationType();

        string aadInstance = Settings.GetSetting("AADInstance");
        string tenant = Settings.GetSetting("Tenant");
        string clientId = Settings.GetSetting("ClientId");
        string postLogoutRedirectURI = Settings.GetSetting("PostLogoutRedirectURI");
        string redirectURI = Settings.GetSetting("RedirectURI");

        string authority = string.Format(CultureInfo.InvariantCulture, aadInstance, tenant);

        Log.Info($"AD Auth Login Start", "adAuth");

        args.App.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            Caption = identityProvider.Caption,
            AuthenticationType = authenticationType,
            AuthenticationMode = AuthenticationMode.Passive,
            ClientId = clientId,
            Authority = authority,
            PostLogoutRedirectUri = postLogoutRedirectURI,
            RedirectUri = redirectURI,


            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                SecurityTokenValidated = notification =>
                {
                    var identity = notification.AuthenticationTicket.Identity;

                    foreach (var claimTransformationService in identityProvider.Transformations)
                    {
                        claimTransformationService.Transform(identity, new TransformationContext(FederatedAuthenticationConfiguration, identityProvider));
                    }

                    notification.AuthenticationTicket = new AuthenticationTicket(identity, notification.AuthenticationTicket.Properties);

                    Log.Info($"AD AuthenticationTicket erstellt", "adAuth");

                    return Task.FromResult(0);
                }

            }
        });
    }

Here the slightly modified claim object I get from Azure

"Claims": [
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {},
    "Type": "aud",
    "Value": "5dc10a7b-a961-458a-8560-1d55cb8943e4",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {},
    "Type": "iss",
    "Value": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/json_type": "System.Int32"
    },
    "Type": "iat",
    "Value": "1554181283",
    "ValueType": "JSON"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/json_type": "System.Int32"
    },
    "Type": "nbf",
    "Value": "1554181283",
    "ValueType": "JSON"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/json_type": "System.Int32"
    },
    "Type": "exp",
    "Value": "1554185183",
    "ValueType": "JSON"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {},
    "Type": "aio",
    "Value": "ASQA2/8KAAAAxWvJNuWVxgVmSFH2Tut1C3Co5y5bl1sAifCP6qRT+rA=",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "amr"
    },
    "Type": "http://schemas.microsoft.com/claims/authnmethodsreferences",
    "Value": "pwd",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {},
    "Type": "c_hash",
    "Value": "HmxzxzxNfpnt3vKkL1t0zg",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "family_name"
    },
    "Type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
    "Value": "Blubb",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "given_name"
    },
    "Type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
    "Value": "Johannes",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {},
    "Type": "groups",
    "Value": "09c44f22-e2e2-4d2d-af90-3ccb0fb3b234",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {},
    "Type": "ipaddr",
    "Value": "15.15.85.212",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {},
    "Type": "name",
    "Value": "Blubb, Johannes - Test",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {},
    "Type": "nonce",
    "Value": "636897783827121098.NjMxZjhlYWYtMTQ4YS00YTlhLWJkMDgtMjgyNTdiYWMwM2UyY2QzOGYzYWMtYmIyOC00MzI2LTg4ZjktNDMzYzgzNDY1MWIy",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "oid"
    },
    "Type": "http://schemas.microsoft.com/identity/claims/objectidentifier",
    "Value": "7edc78ef-6666-6672-97d5-d8f643d6b47e",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {},
    "Type": "onprem_sid",
    "Value": "S-1-5-21-1456952878-1040323209-000000000-6677",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "sub"
    },
    "Type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
    "Value": "AnEOzDgyzeS4VcBNdElrZ2i_-BaW1HfABM_GK_DbMME",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "tid"
    },
    "Type": "http://schemas.microsoft.com/identity/claims/tenantid",
    "Value": "b076d2cb-aaaa-4977-aaaa-18266dbcf8f0",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "unique_name"
    },
    "Type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
    "Value": "[email protected]",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/ShortTypeName": "upn"
    },
    "Type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn",
    "Value": "[email protected]",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {},
    "Type": "uti",
    "Value": "uXQBhCnoFUCybAGqyjBBBB",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    },
    {
    "Issuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "OriginalIssuer": "https://sts.windows.net/b076d2cb-aaaa-4977-aaaa-18266dbcf8f0/",
    "Properties": {},
    "Type": "ver",
    "Value": "1.0",
    "ValueType": "http://www.w3.org/2001/XMLSchema#string"
    }
],

I think I've some lack of understanging what is going on here or I what I am missing?

Improve this question
10
  • Can you confirm that you are getting groups claims back when you authenticate?
    – Bic
    Commented Apr 1, 2019 at 23:00
  • @Bic I've added my backend AzureAdItendity Provider function, perhaps you could tell me where I could see if I get a groups claim back?
    – squadwuschel
    Commented Apr 2, 2019 at 4:58
  • @Bic when I log the "identity" variable above I see my username, email, ... I think I get back everythink right.
    – squadwuschel
    Commented Apr 2, 2019 at 5:14
  • Ideally, you can debug, and step through to see what your claims are. If not, then you should log more than just the root identity object. The claims would be a property of the identity.
    – Bic
    Commented Apr 2, 2019 at 12:58
  • 1
    You will have to create a custom DefaultExternalUserBuilder and put in logic there to build the user with the correct name, otherwise the username comes as the random string you see. Since the login into sitecore is working it seems like the user is getting some roles. How are these getting assigned?
    – Jeroen
    Commented Apr 2, 2019 at 13:36

1 Answer 1

Reset to default
0

I got a part of my solution for the strange username shown on the right above. The Full name was not mapped and also no email was mapped, because of the Claim Property names where not right for me. So I've added a logger for the Identity

Log.Info($"Identity {JsonConvert.SerializeObject(identity, Formatting.Indented, new JsonSerializerSettings() { ReferenceLoopHandling = ReferenceLoopHandling.Ignore })}", "adAuth");

and in the logfile I've seen that my Properties are mapped to the following claimes and property names. Now I see my username when I log in.

enter image description here

<propertyInitializer type="Sitecore.Owin.Authentication.Services.PropertyInitializer, Sitecore.Owin.Authentication">
    <maps hint="list">
      <map name="email claim" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
        <data hint="raw:AddData">
          <!--claim name-->
          <source name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" />
          <!--property name-->
          <target name="Email" />
        </data>
      </map>
      <map name="Name claim" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
        <data hint="raw:AddData">
          <!--claim name-->
          <source name="name" />
          <!--property name-->
          <target name="Name" />
        </data>
      </map>
    </maps>
  </propertyInitializer>

But when I take a look on my user the User Name ist still a random string. Is this right? => Yes thats Right, here I should need to overright the user creation (https://doc.sitecore.com/developers/91/sitecore-experience-management/en/use-the-sitecore-identity-server-as-a-federation-gateway.html)

When you are able to Login, then your Role Mapping is working! Because when it's not working you get an error that you are not allowed to login.

And when you look in the "Members of" tab from your Azure Login user you will not see any assigned roles here that's RIGHT!

So my only Problem was that my mappings where not right for email and username. The Role mapping was working right.

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.