How do I map my IdentityServer Claims to CustomProperties on the UserProfile?

Question

We're on Sitecore 9.1.1.

I'm in the process of integrating Sitecore IdentityServer to our Azure AD, and have login working. I am now wanting to map AAD attributes to the user Sitecore generates for me. I've been following Derek Correria's guide and mapped out the first properties like this:

<ClaimsTransformation1 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
  <SourceClaims>
    <Claim1 type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" />
  </SourceClaims>
  <NewClaims>
    <Claim1 type="email" />
  </NewClaims>
</ClaimsTransformation1 >
<ClaimsTransformation2 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
  <SourceClaims>
    <Claim1 type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
  </SourceClaims>
  <NewClaims>
    <Claim1 type="comment" />
  </NewClaims>
</ClaimsTransformation2>
<ClaimsTransformation3 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
  <SourceClaims>
    <Claim1 type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
  </SourceClaims>
  <NewClaims>
    <Claim1 type="name" />
  </NewClaims>
</ClaimsTransformation3>

And mapped like this

<propertyInitializer>
    <maps>
        <map name="set Email" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
            <data hint="raw:AddData">
                <source name="email" />
                <target name="Email" />
            </data>
        </map>
        <map name="set Comment" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
            <data hint="raw:AddData">
                <source name="comment" />
                <target name="Comment" />
            </data>
        </map>
        <map name="set FullName" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
            <data hint="raw:AddData">
                <source name="name" />
                <target name="FullName" />
            </data>
        </map>
    </maps>
</propertyInitializer>

Which works fine. But there are additional attributes on the AAD users which I want to carry across. There are no more default properties on a User that I can use, so I'm thinking to map the remaining attributes to CustomProperties. How do I do that though? Neither documentation nor Derek's guide seems to touch on this.

TL;DR; how can I map an IdentityServer Claim to User.CustomProperty["key"]?

Answer 1

I've added a new post on my blog here: https://sitecore.derekc.net/extending-sitecore-identitys-sitecore-profile-to-map-additional-profile-data/. Summary below:

So three steps to add a field that exists in UserProfile to Sitecore:

• Add the field to sitecore.profile in Sitecore Identity
• Create a claim transform in Sitecore Identity
• Map the claim in Sitecore

In the identityServer.xml on SI, add a new UserClaim to the node with the name of the claim going to Sitecore (the comment claim below):

      <IdentityResources>
        <SitecoreIdentityResource>
          <Name>sitecore.profile</Name>
          <UserClaims>
            <UserClaim1>name</UserClaim1>
            <UserClaim2>email</UserClaim2>
            <UserClaim3>role</UserClaim3>
            <UserClaim4>http://www.sitecore.net/identity/claims/isAdmin</UserClaim4>
            <UserClaim5>http://www.sitecore.net/identity/claims/originalIssuer</UserClaim5>
            <UserClaim6>comment</UserClaim6>
          </UserClaims>
          <Required>true</Required>
        </SitecoreIdentityResource>
      </IdentityResources>

Add a claim transformation to Sitecore Identity (if the claim is nonstandard, here is how to pass nonstandard attributes as claims):

            <StateToComment type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
              <SourceClaims>
                <Claim1 type="state" />
              </SourceClaims>
              <NewClaims>
                <Claim1 type="comment" />
              </NewClaims>
            </StateToComment >

Finally, create a map in Sitecore:

          <map name="set Comment" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
            <data hint="raw:AddData">
              <source name="comment" />
              <target name="Comment" />
            </data>
          </map>

If the property you're writing to in Sitecore isn't easily accessible by profile, there's an abstract ClaimToPropertyMapper in the Sitecore.Owin.Authentication.Services namespace that could be leveraged to map all claims to custom property claims. Would require filling all of the implementation. More likely you'd want to inherit off of the DefaultClaimToPropertyMapper instead and override the MapCore method.

private void SavePropertyViaIndexer(User user, Claim sourceClaim)
    {
        user.Profile[Target] = (TargetValue ?? sourceClaim.Value);
    }

Seems it should be easy enough to make those custom properties on the profile instead. Again, haven't tried this but was looking into something similar at one point. Good luck!