Sitecore Content Hub Azure Active Directory Login

Question

I am trying to implement Azure AD in my Content Hub portal. I have created the App in Azure Active Directory and also add the Application ID URI, federation metadata & get the Entity Id.

In my Content Hub portal, I have updated the ExternalAuthenticationProviders.saml and saved the same.

"ExternalAuthenticationProviders": {
    "global_username_claim_type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
    "global_email_claim_type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
    "saml": [
      {
        "metadata_location": "https://login.microsoftonline.com/<id>/federationmetadata/2007-06/federationmetadata.xml",
        "sp_entity_id": "api://<id>",
        "idp_entity_id": "https://sts.windows.net/<id>/",
        "password": null,
        "certificate": null,
        "binding": "HttpRedirect",
        "authn_request_protocol_binding": null,
        "is_enabled": true,
        "provider_name": "SamlNewLocal",
        "messages": {
          "signIn": "Azure AD",
          "signInDescription": "Azure AD",
          "signInTitle": "Azure AD"
        },
        "authentication_mode": "Active"
      }  
    ]
  }

After this, I can do the login using the admin (my own email id) successfully. But the problem is I am not able to log in with other users.

Getting the below error from Content Hub:

Need your help on this, I have also enabled EnableRegister to true for new users. The domain I am using is user@<my domain>.onmicrosoft.com (Free AD).

Can anyone please highlight any point or any configuration?

Answer 1

To enable the Microsoft login, you just need the client id & secret. And put the follwing json settings in ExternalAuthenticationProviders.

"microsoft": [
      {
        "authentication_mode": "Passive",
        **"client_id": "<client id>",**
        **"client_secret": "<client secret>",**
        "email_claim_type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
        "external_user_creation_url": "",
        "is_enabled": true,
        "messages": {
          "signIn": "Microsoft Sign In",
          "signInDescription": "",
          "signInTitle": "Microsoft Sign In"
        },
        "provider_name": "Microsoft",
        "username_claim_type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
      }
    ]

And make sure the AutoCreateUsers & EnableCredentialless is true.