So we have Azure AD integration set up via Identity Server. We're on 9.1.1.
By default the Sitecore.Plugin.IdentityProvider.AzureAd.xml configuration on IdentityServer, maps the isAdministrator claim something like this.
<AzureADUserToAdminUser type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders"> <SourceClaims> <Claim1 type="groups" value="[redacted]" /> </SourceClaims> <NewClaims> <Claim1 type="http://www.sitecore.net/identity/claims/isAdmin" value="true"/> </NewClaims> </AzureADUserToAdminUser>
So based on a group membership, users will get the
http://www.sitecore.net/identity/claims/isAdmin claim mapped, with a value of
On the Sitecore side of things, the default handling of this is the propertyInitializer, and it looks like this.
<propertyInitializer> <maps> <map name="set IsAdministrator" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication"> <data hint="raw:AddData"> <source name="http://www.sitecore.net/identity/claims/isAdmin" value="true" /> <target name="IsAdministrator" value="true" /> </data> </map> </maps> </propertyInitializer>
Which, the way I understand it, is configuration speak for "if user has claim
http://www.sitecore.net/identity/claims/isAdmin with a value of
true, then set the
IsAdministrator value to
We are also going with the default configuration of Persistent Users.
So here is my problem. If a user, at any point in time, has been granted the
IsAdministrator claim - it stays forever. Removing the user from the original Security Group does nothing -
IsAdministrator never gets set to false. It just goes untouched, if a user doesn't have the claim.
HOW is it supposed to be configured, so this flag gets set AND cleared based on the Security Group membership?