4

We are using Sitecore 9.2 and have several different instances (completely separated with its own deployment for creating different websites).

We want to introduce Azure AD login to use domain login and get two-factor authentication already implemented in Azure. There are different security groups that should give access to the different CM sites.

We expected that we could use one Sitecore Identity Server instance, like this:

Overall diagram

Hereby we can configure Azure AD identity provider once (and the client create one App Registration in Azure Portal), which would be really great.

How to handle the different access rights per site. We assumed that we could let identity server do claims transformation to handle the azure group id mapping to some logical names, and then use claims transformation on the actual CM site to map from those logical names to the real sitecore roles.

Authentication sequence

However, what we experience is that the user is redirected from the identity server callback page to the login page with a message indicating that the user don't have access.

I have tried decompiling the Sitecore.Plugin.IdentityServer.Controllers.AccountController to inspect the ExternalLoginCallback action method which seems to be the one making redirect to the login page with the sc_message querystring. However I don't really see anything related to this, so it must happen somewhere along the Authenticate owin pipeline.

Do anyone know if it is possible to configure/override that validation if the user is allowed to use the system? Have anyone tried to do something similar?

Thank you for your time!

Improve this question
3
  • I notice that there is an similar but older question related to this: sitecore.stackexchange.com/questions/16085/…
    – Jesper Balle
    Commented Dec 17, 2019 at 15:12
  • We can achieve the above scenario and that is something I have recently implemented. When you get "You dont have access" it is always the claim transformation issue. make sure your are getting the proper ID token and custom claim roles name are properly transferred to Sitecore roles in your claims transformation file on the identity server.
    – vdivya
    Commented Feb 19, 2020 at 18:57
  • @JesperBalle can you provide your claim mappings ? seems like you are not assigning correct role as vdivya has mentioned
    – scFootsteps
    Commented Mar 10, 2020 at 18:10

3 Answers 3

Reset to default
1

Please try doing Claims mappings troubleshooting using ASP.NET 2.0 Membership Tables.

Appears to be an issue with claim mappings into Identity Server. All the source claims originating from AzureAd are captured and stored in the Core database, within the ExternalUserData table, as shown in the screenshot below:

ExternalUserData

I have blogged this recently, if it is of additional help

Improve this answer
0

We can debug this issue further by creating one dummy user for each sites and assign them desiered sitecore roles. Login to sitecore (without AD) using dummy users with login name and password to see if the sitecore roles created have correct access rights on different sites.

If above use case is working fine then there is only problem with the claim transformation thoes are configured in AD vs Sitecore roles.

Improve this answer
0

Sorry you my late reply here. Thank you very much for you replies.

We evaluated the usage, it is possible to setup the claims correctly.

Our issue was that we wanted to achieve that one user had access to eg. only CM1 instance and another one only to CM2. However Sitecore Identity Server is twisted and tied together with the core/membership database. So to achieve this, it is necessary that all CMs share the same membership database (basically the result of the related old answer). Hereby we need to have all roles on all CMs and make very specific security configuration on content to only allow the required access and basically override built-in access such as Sitecore Client User.

I acknowledge that it is a special case that we want to support multiple CMs but use almost completely different security setup. What we want to achieve can easily be achieved by having an Identity Server pr. CM/Sitecore installation.

Due to some strange hosting restrictions we could not introduce an Identity Server pr. installation so we actually ended up using the older Sitecore Federated Authentication to authenticate to Azure with same clientId but have completely different configuration of claims transformation per instance

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.