We are using Sitecore 9.2 and have several different instances (completely separated with its own deployment for creating different websites).
We want to introduce Azure AD login to use domain login and get two-factor authentication already implemented in Azure. There are different security groups that should give access to the different CM sites.
We expected that we could use one Sitecore Identity Server instance, like this:
Hereby we can configure Azure AD identity provider once (and the client create one App Registration in Azure Portal), which would be really great.
How to handle the different access rights per site. We assumed that we could let identity server do claims transformation to handle the azure group id mapping to some logical names, and then use claims transformation on the actual CM site to map from those logical names to the real sitecore roles.
However, what we experience is that the user is redirected from the identity server callback page to the login page with a message indicating that the user don't have access.
I have tried decompiling the
Sitecore.Plugin.IdentityServer.Controllers.AccountController to inspect the
ExternalLoginCallback action method which seems to be the one making redirect to the login page with the
sc_message querystring. However I don't really see anything related to this, so it must happen somewhere along the Authenticate owin pipeline.
Do anyone know if it is possible to configure/override that validation if the user is allowed to use the system? Have anyone tried to do something similar?
Thank you for your time!