4

I have a user coming in from Azure AD (following this example to start: http://sitecore.badalkotecha.com/2017/11/federated-authentication-for-sitecore-9-integrating-with-azuread.html). When I use isPersistentUser set to true, so the user is stored in User Manager, I don't see the associated roles that I have mapped from Azure to Sitecore, or the correct user profile information (the default one with the wallpaper, etc).

I've stepped through the user record in the external user builder's BuildUser function (I extended my own to write a "real" username, instead of the hash one in the DefaultExternalUserBuilder and I see the correct profile ID assigned. But, when I hit the Sitecore desktop, there's no wallpaper, so there does appear to be a disconnect somewhere.

Also, when I log in as the user, the correct permissions are being applied based on the roles assigned, so that seems to be working at least. I've tried setting the keepSource value to both true and false, but I'm not seeing a difference either way. If the roles are functioning correctly, that's good, but of course without them actually assigned to the persistent user, I can't use the access viewer to check their permissions for any problem spots.

Improve this question

2 Answers 2

Reset to default
6

I heard from Sitecore support on the roles at least, so I wanted to share this answer:

The concept of the Federated Authentication means that you delegate authentication to a trusted identity provider and all the users are managed on the side of this provider. Based on this the User Manager usage is not intended to maintain users from aside providers and for now does not designed to view the roles which were mapped to Sitecore roles. Please consider using Azure portal to maintain and view the roles for the AzureAD users. The same is applicable to the Access Viewer: You have to manage access rights not for the AzureAD user, but for Sitecore role which is mapped to this user.

Based on this, even though you can map multiple Sitecore roles to an Azure AD group in the transform configuration, you should not do it. It seems like the best practice would be to create a Sitecore role with the a matching name to the Azure group (maybe even naming convention it like sitecore\Azure [Group Name] so you know where/why you have it) and then have that role inherit the necessary roles.

The Sitecore support rep said he'd put in a documentation request to add this information for clarity purposes. I'm still asking about the profile bit, where it's not "catching" the default profile, but I'm doing a separate ticket there because it could be a bug.

UPDATE: Sitecore Support has confirmed the profile data not working correctly with federated authentication is a bug and have sent me a support patch. The public reference number is 208132 so we can all track it going forward into future Sitecore updates.

Improve this answer
0

Sitecore does not support the following features for such users:

  • Reading and deleting roles of external users in the User Manager because these roles are not stored in Sitecore.
  • Because of this, using the Access Viewer.
  • Changing a user password. You have to change passwords it in the corresponding identity provider.

For this case, you should use access viewer instead of roles as well

Improve this answer
2
  • What do you mean by using Access Viewer? How could Access Viewer help in both cases?
    – Peter Procházka
    Apr 4, 2018 at 5:49
  • I mean the role of user is not store on database after new user is auto create. So if you want to config some special permission for this user you can assign new role or change Security Editor for this user. About profile you can check all mapping claim of Azure AD in here : docs.microsoft.com/en-us/azure/active-directory/…
    – Cuong Nguyen
    Apr 4, 2018 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.