We are using Sitecore 9.2 and have several different instances (completely separated with its own deployment for creating different websites).

We want to introduce Azure AD login to use domain login and get two-factor authentication already implemented in Azure. There are different security groups that should give access to the different CM sites.

We expected that we could use one Sitecore Identity Server instance, like this:

Overall diagram

Hereby we can configure Azure AD identity provider once (and the client create one App Registration in Azure Portal), which would be really great.

How to handle the different access rights per site. We assumed that we could let identity server do claims transformation to handle the azure group id mapping to some logical names, and then use claims transformation on the actual CM site to map from those logical names to the real sitecore roles.

Authentication sequence

However, what we experience is that the user is redirected from the identity server callback page to the login page with a message indicating that the user don't have access.

I have tried decompiling the Sitecore.Plugin.IdentityServer.Controllers.AccountController to inspect the ExternalLoginCallback action method which seems to be the one making redirect to the login page with the sc_message querystring. However I don't really see anything related to this, so it must happen somewhere along the Authenticate owin pipeline.

Do anyone know if it is possible to configure/override that validation if the user is allowed to use the system? Have anyone tried to do something similar?

Thank you for your time!

  • I notice that there is an similar but older question related to this: sitecore.stackexchange.com/questions/16085/… Dec 17 '19 at 15:12
  • We can achieve the above scenario and that is something I have recently implemented. When you get "You dont have access" it is always the claim transformation issue. make sure your are getting the proper ID token and custom claim roles name are properly transferred to Sitecore roles in your claims transformation file on the identity server.
    – vdivya
    Feb 19 '20 at 18:57
  • @JesperBalle can you provide your claim mappings ? seems like you are not assigning correct role as vdivya has mentioned Mar 10 '20 at 18:10

Please try doing Claims mappings troubleshooting using ASP.NET 2.0 Membership Tables.

Appears to be an issue with claim mappings into Identity Server. All the source claims originating from AzureAd are captured and stored in the Core database, within the ExternalUserData table, as shown in the screenshot below:


I have blogged this recently, if it is of additional help

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.