So we have Azure AD integration set up via Identity Server. We're on 9.1.1.
By default the Sitecore.Plugin.IdentityProvider.AzureAd.xml configuration on IdentityServer, maps the isAdministrator claim something like this.
<AzureADUserToAdminUser type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
<SourceClaims>
<Claim1 type="groups" value="[redacted]" />
</SourceClaims>
<NewClaims>
<Claim1 type="http://www.sitecore.net/identity/claims/isAdmin" value="true"/>
</NewClaims>
</AzureADUserToAdminUser>
So based on a group membership, users will get the http://www.sitecore.net/identity/claims/isAdmin claim mapped, with a value of true.
On the Sitecore side of things, the default handling of this is the propertyInitializer, and it looks like this.
<propertyInitializer>
<maps>
<map name="set IsAdministrator" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication">
<data hint="raw:AddData">
<source name="http://www.sitecore.net/identity/claims/isAdmin" value="true" />
<target name="IsAdministrator" value="true" />
</data>
</map>
</maps>
</propertyInitializer>
Which, the way I understand it, is configuration speak for "if user has claim http://www.sitecore.net/identity/claims/isAdmin with a value of true, then set the IsAdministrator value to True".
We are also going with the default configuration of Persistent Users.
So here is my problem. If a user, at any point in time, has been granted the IsAdministrator claim - it stays forever. Removing the user from the original Security Group does nothing - IsAdministrator never gets set to false. It just goes untouched, if a user doesn't have the claim.
HOW is it supposed to be configured, so this flag gets set AND cleared based on the Security Group membership?
