3

I tried to integrate Sitecore 9 with Azure AD. It was successful. I have used persistent user setting therefore user is automatically created.

Unfortunately, in old system some users already existed.

I want to follow business requirements:

  • If Azure AD account has same email with a old account => it will be mapped and no need to create new user

How can I achieve this with federated authentication?

1
  • hey Cuong, can you post your code? I believe you'd need to achieve this in the middleware. I belive the issue might be related to the default ExternalUserBuilder as it creates a random username so it might not be detecting the user (if you are using the sample configuration that comes with sitecore 9)
    – josedbaez
    Apr 10, 2018 at 10:40

2 Answers 2

0

You can do this by overriding CreateUniqueUserName in default ExternalUserBuilder and also implementing your own ApplicationUserResolver.

https://www.xcentium.com/blog/2019/11/27/how-to-avoid-nonsensical-usernames-when-integrating-sitecore-9dot1-with-active-directory

https://www.linkedin.com/pulse/resolve-your-owin-external-user-own-way-arvind-gehlot

1
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Oct 6, 2021 at 6:28
0

To map existing Sitecore users with Azure AD accounts based on email addresses, you can modify the code that handles federated authentication in your Sitecore instance. Specifically, you'll need to intercept the authentication pipeline and add a custom code that checks for existing users with matching email addresses.

Here's a high-level overview of the steps you can take:

  1. Create a custom processor that intercepts the authentication pipeline after the Azure AD authentication provider. You can use the owin.authentication.identityProviders pipeline to achieve this.

  2. In your custom processor, retrieve the email address of the authenticated user from the claims provided by the Azure AD authentication provider. You can access the claims using the GetExternalClaims method of the ExternalLoginInfo object.

  3. Query the Sitecore user database to check for any existing users with a matching email address. You can use the Sitecore.Security.Accounts.UserManager class to retrieve users by email address.

  4. If a matching user is found, set the authentication ticket for that user and bypass the rest of the authentication pipeline. You can use the Sitecore.Security.Authentication.AuthenticationManager class to set the authentication ticket.

  5. If no matching user is found, allow the authentication pipeline to proceed as normal, which will create a new user based on the Azure AD account.

Here's an example code snippet to get you started:

public class SitecoreAzureADMappingProcessor : Owin.Authentication.Pipelines.IdentityProviders.IdentityProvidersProcessor
{
    public override void Process(IdentityProvidersArgs args)
    {
        // Retrieve the email address of the authenticated user from the claims
        var externalLoginInfo = args.ExternalLoginInfo;
        var email = externalLoginInfo.GetExternalClaims().FirstOrDefault(c => c.Type == ClaimTypes.Email)?.Value;

        if (!string.IsNullOrEmpty(email))
        {
            // Query the Sitecore user database for a user with a matching email address
            var userManager = UserManager.GetManager();
            var user = userManager.FindByEmail(email);

            if (user != null)
            {
                // Set the authentication ticket for the existing user and bypass the rest of the pipeline
                AuthenticationManager.Login(user);
                args.IdentityProviderHandled = true;
                return;
            }
        }

        // Allow the pipeline to proceed as normal, which will create a new user based on the Azure AD account
        base.Process(args);
    }
}

You'll need to register your custom processor in the owin.authentication.identityProviders pipeline in your Sitecore configuration file, like this:

<owin.authentication.identityProviders>
  <processor type="YourNamespace.SitecoreAzureADMappingProcessor, YourAssembly" resolve="true" />
</owin.authentication.identityProviders>

Note that this is just a starting point, and you may need to modify this code to fit the specific requirements of your project

Helpful links

  1. https://www.xcentium.com/blog/2019/11/27/how-to-avoid-nonsensical-usernames-when-integrating-sitecore-9dot1-with-active-directory

  2. https://www.linkedin.com/pulse/resolve-your-owin-external-user-own-way-arvind-gehlot

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.