4

So we have Azure AD integration set up via Identity Server. We're on 9.1.1.

By default the Sitecore.Plugin.IdentityProvider.AzureAd.xml configuration on IdentityServer, maps the isAdministrator claim something like this.

<AzureADUserToAdminUser type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
    <SourceClaims>
        <Claim1 type="groups" value="[redacted]" />
    </SourceClaims>
    <NewClaims>
        <Claim1 type="http://www.sitecore.net/identity/claims/isAdmin" value="true"/>
    </NewClaims>
</AzureADUserToAdminUser>

So based on a group membership, users will get the http://www.sitecore.net/identity/claims/isAdmin claim mapped, with a value of true.

On the Sitecore side of things, the default handling of this is the propertyInitializer, and it looks like this.

<propertyInitializer>
 <maps>
    <map name="set IsAdministrator" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
        <data hint="raw:AddData">
            <source name="http://www.sitecore.net/identity/claims/isAdmin" value="true" />
            <target name="IsAdministrator" value="true" />
        </data>
    </map>
 </maps>
</propertyInitializer>

Which, the way I understand it, is configuration speak for "if user has claim http://www.sitecore.net/identity/claims/isAdmin with a value of true, then set the IsAdministrator value to True".

We are also going with the default configuration of Persistent Users.

So here is my problem. If a user, at any point in time, has been granted the IsAdministrator claim - it stays forever. Removing the user from the original Security Group does nothing - IsAdministrator never gets set to false. It just goes untouched, if a user doesn't have the claim.

HOW is it supposed to be configured, so this flag gets set AND cleared based on the Security Group membership?

  • Can you add a propertyInitializer to see IsAdministrator to false, using a source claim that all users have? And then as long as this is executed before your isAdmin propertyInitializer above, it will set this to false by default, and then back to true for admins. I'm not sure if this would be considered a workaround or a "correct" approach to this, even if it works, however. – Kasaku Aug 4 at 21:00
  • It's a little bit of both I would say :D I wonder if I could just fake a claim... You've got me thinking, will report back :-) – Mark Cassidy Aug 5 at 3:51
0

Not much of an answer, but I can say that this has been confirmed as a bug. As of Sitecore version 9.2, this is still unresolved.

I just followed up, and there is no official bug reference for this. If encountered, the best action would be to go via Sitecore Support.

  • Is there a bug number or patch? – Dylan McCurry Oct 15 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.