I have successfully setup Federated Authentication for the Sitecore client with Azure AD. However we have some additional requirements to meet:

  • A user must be within a given AD group to be able to login
  • Valid users should be persisted, so that roles can be maintained in Sitecore

For a user performing their first login, if the identity's claims are not transformed into a role, Sitecore will inform the user they do not have access. However the user is still created within Sitecore (if persistence is enabled), and if user is then added as a member of a role including client access, they will then have access even if do not meet the AD group requirement.

To accomplish this, looking at other examples outside of Sitecore, I thought the appropriate place for this criteria check would be within the SecurityTokenValidated notification:

args.App.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
    .. other required properties omitted ..

    Notifications = new OpenIdConnectAuthenticationNotifications
        SecurityTokenValidated = notification =>
            var identity = notification.AuthenticationTicket.Identity;

            foreach (var claimTransformationService in identityProvider.Transformations)
                    new TransformationContext(FederatedAuthenticationConfiguration, identityProvider));

            // Must have mapped to at least one role as a result of our transformations.
            if (!identity.HasClaim(c => c.Type.Equals(ClaimTypes.Role, StringComparison.InvariantCultureIgnoreCase)))
                throw new System.IdentityModel.Tokens.SecurityTokenValidationException("User must be mapped to at least one role");

            notification.AuthenticationTicket = new AuthenticationTicket(identity, notification.AuthenticationTicket.Properties);

            return Task.FromResult(0);                      


Here, we perform our criteria check and throw a SecurityTokenValidationException. However, in Sitecore this results in the exception bubbling up and presenting a YSOD, rather than the user being taken back to the login screen and told they failed authentication. Whilst this is preventing the login, the experience for the user is bad.

What's the correct way to achieve this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.