6

We're on Sitecore 9.1.1.

I'm in the process of integrating Sitecore IdentityServer to our Azure AD, and have login working. I am now wanting to map AAD attributes to the user Sitecore generates for me. I've been following Derek Correria's guide and mapped out the first properties like this:

<ClaimsTransformation1 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
  <SourceClaims>
    <Claim1 type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" />
  </SourceClaims>
  <NewClaims>
    <Claim1 type="email" />
  </NewClaims>
</ClaimsTransformation1 >
<ClaimsTransformation2 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
  <SourceClaims>
    <Claim1 type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
  </SourceClaims>
  <NewClaims>
    <Claim1 type="comment" />
  </NewClaims>
</ClaimsTransformation2>
<ClaimsTransformation3 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
  <SourceClaims>
    <Claim1 type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
  </SourceClaims>
  <NewClaims>
    <Claim1 type="name" />
  </NewClaims>
</ClaimsTransformation3>

And mapped like this

<propertyInitializer>
    <maps>
        <map name="set Email" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
            <data hint="raw:AddData">
                <source name="email" />
                <target name="Email" />
            </data>
        </map>
        <map name="set Comment" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
            <data hint="raw:AddData">
                <source name="comment" />
                <target name="Comment" />
            </data>
        </map>
        <map name="set FullName" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
            <data hint="raw:AddData">
                <source name="name" />
                <target name="FullName" />
            </data>
        </map>
    </maps>
</propertyInitializer>

Which works fine. But there are additional attributes on the AAD users which I want to carry across. There are no more default properties on a User that I can use, so I'm thinking to map the remaining attributes to CustomProperties. How do I do that though? Neither documentation nor Derek's guide seems to touch on this.

TL;DR; how can I map an IdentityServer Claim to User.CustomProperty["key"]?

6

I've added a new post on my blog here: https://sitecore.derekc.net/extending-sitecore-identitys-sitecore-profile-to-map-additional-profile-data/. Summary below:

So three steps to add a field that exists in UserProfile to Sitecore:

  • Add the field to sitecore.profile in Sitecore Identity
  • Create a claim transform in Sitecore Identity
  • Map the claim in Sitecore

In the identityServer.xml on SI, add a new UserClaim to the node with the name of the claim going to Sitecore (the comment claim below):

      <IdentityResources>
        <SitecoreIdentityResource>
          <Name>sitecore.profile</Name>
          <UserClaims>
            <UserClaim1>name</UserClaim1>
            <UserClaim2>email</UserClaim2>
            <UserClaim3>role</UserClaim3>
            <UserClaim4>http://www.sitecore.net/identity/claims/isAdmin</UserClaim4>
            <UserClaim5>http://www.sitecore.net/identity/claims/originalIssuer</UserClaim5>
            <UserClaim6>comment</UserClaim6>
          </UserClaims>
          <Required>true</Required>
        </SitecoreIdentityResource>
      </IdentityResources>

Add a claim transformation to Sitecore Identity (if the claim is nonstandard, here is how to pass nonstandard attributes as claims):

            <StateToComment type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
              <SourceClaims>
                <Claim1 type="state" />
              </SourceClaims>
              <NewClaims>
                <Claim1 type="comment" />
              </NewClaims>
            </StateToComment >

Finally, create a map in Sitecore:

          <map name="set Comment" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
            <data hint="raw:AddData">
              <source name="comment" />
              <target name="Comment" />
            </data>
          </map>

If the property you're writing to in Sitecore isn't easily accessible by profile, there's an abstract ClaimToPropertyMapper in the Sitecore.Owin.Authentication.Services namespace that could be leveraged to map all claims to custom property claims. Would require filling all of the implementation. More likely you'd want to inherit off of the DefaultClaimToPropertyMapper instead and override the MapCore method.

private void SavePropertyViaIndexer(User user, Claim sourceClaim)
    {
        user.Profile[Target] = (TargetValue ?? sourceClaim.Value);
    }

Seems it should be easy enough to make those custom properties on the profile instead. Again, haven't tried this but was looking into something similar at one point. Good luck!

  • Turns out, one can't actually request additional claims in this manner. The Claim mappings one configures, only act against what's in the initial payload coming back from the provider by default - no additional queries are made. – Mark Cassidy Jul 29 at 7:31
  • Ah, sorry Mark -- I thought you were looking for something already in the manifest. You should be able to specify additional claims you'd like Azure to pass through in the custom optional claims space. More info here: docs.microsoft.com/en-us/azure/active-directory/develop/… – Derek C Jul 30 at 15:06
  • That article is very confusing :P I've now tried it a number of ways, and nothing seems to have the desired effect. It seems only a very specific list of claims can be requested in this manner? – Mark Cassidy Aug 9 at 11:54
  • I took a stab at walking through a solution, perhaps this would meet the need you have. sitecore.derekc.net/… – Derek C Aug 12 at 15:27
  • 1
    It's an interesting idea, unfortunately not one I'd be familiar with so far. The issue appears to be less with the SI scope and what Azure is able to pass as attributes. I think if the claim you're looking for is listed in the optional attributes, you should be able to get it by changing the optional claims sets. Otherwise, claim mapping policy is the only way I'm aware of. I believe the preview nature is more in line with "it might not be available at the free tier" going forward, but understand the uneasiness on the customer side! – Derek C Aug 12 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.