Mapping property in Sitecore 9 federated authentication

Question

I am trying to implement federated authentication using google in my Sitecore 9 application (CMS not website). I am bale to login to Sitecore using GoogleOAuth2Authentication and i am using persistent user, so that user is automatically created when they logged on to Sitecore using Gmail.

The problem i am facing is that, in Sitecore, for that particular user, there is no email or full name set to identify and provide access. The mapping I am using is as below:

<propertyInitializer type="Sitecore.Owin.Authentication.Services.PropertyInitializer, Sitecore.Owin.Authentication">
  <!--List of property mappings
      Note that all mappings from the list will be applied to each providers-->
  <maps hint="list">
    <!--The mapping sets the Email property of the user profile from emailaddress claim-->
    <map name="email claim" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
      <data hint="raw:AddData">
        <!--claim name-->
        <source name="Email" />
        <!--property name-->
        <target name="Email" />
      </data>
    </map>
    <map name="name claim" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
      <data hint="raw:AddData">
        <!--claim name-->
        <source name="Name" />
        <!--property name-->
        <target name="Full name" />
      </data>
    </map>
  </maps>
</propertyInitializer>

I need help in defining the condition, so that name and email field can directly be filled.

Also, In case, if I allow the user to be created automatically in Sitecore, it will result in creating user for all those who logged on to system through gmail. Is there a way, through which I create a user in Sitecore manually and allow only those user with matching email id from gmail authentication?

Answer 1

You are using invalid claim names in your configuration.

You should use it this way:

<map name="email claim" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
 <data hint="raw:AddData">
  <!--claim name-->
  <source name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
  <!--property name-->
  <target name="Email" />
 </data>
</map>

<map name="name claim" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
 <data hint="raw:AddData">
  <!--claim name-->
  <claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
  <!--property name-->
  <target name="FullName" />
 </data>
</map>

To have nicer names instead of some Gibberish, you should first transform name claim like this:

<!--Add Full Name Claim Transformation-->
<transformation name="name" type="Sitecore.Owin.Authentication.Services.DefaultTransformation,Sitecore.Owin.Authentication">
 <sources hint="raw:AddSource">
        <claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
 </sources>
 <targets hint="raw:AddTarget">
        <claim name="FullName" />
 </targets>
</transformation>

And then use it like this:

<map name="name claim" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
 <data hint="raw:AddData">
  <!--claim name-->
  <source name="FullName" />
  <!--property name-->
  <target name="FullName" />
 </data>
</map>

Take a look on series of blog posts by nikkipunjabi for further details:

1. http://blog.nikkipunjabi.com/2018/02/sitecore-federated-authentication-part-1-authentication-google-facebook-identity-providers.html
2. http://blog.nikkipunjabi.com/2018/03/sitecore-federated-authentication-part-2-google-and-facebook-app-and-the-custom-processor.html
3. http://blog.nikkipunjabi.com/2018/03/sitecore-federated-authentication-part-3-sitecore-user-and-claims-identity.html

Answer 2

I implemented a custom user builder by inheriting from ExternalUserBuilder where i override the CreateUniqueUserName method to provide the email as username and now the user created is having username as email instead of guid based name. Not tested it fully but below is the code snippet

 [SuppressMessage("Microsoft.Naming", "CA1726:UsePreferredTerms", MessageId = "Login")]
        protected virtual string CreateUniqueUserName(UserManager<ApplicationUser> userManager, ExternalLoginInfo externalLoginInfo)
        {
            Assert.ArgumentNotNull((object)userManager, nameof(userManager));
            Assert.ArgumentNotNull((object)externalLoginInfo, nameof(externalLoginInfo));
            IdentityProvider identityProvider = this.FederatedAuthenticationConfiguration.GetIdentityProvider(externalLoginInfo.ExternalIdentity);
            if (identityProvider == null)
                throw new InvalidOperationException("Unable to retrieve identity provider for given identity");
            string domain = identityProvider.Domain;
            return domain + "\\" + externalLoginInfo.Email;

        }