I followed the steps here https://sitecore.derekc.net/setting-up-azure-active-directory-integration-with-sitecore-identity-server-sitecore-9-1/ to get this set up and it is all great. However, even with a group mapping setup I still get an error that I am not authorized. Digging into the OWIN logs I find this error.
22780 15:36:01 WARN An error with Nonce cookie occured. Exception: Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolInvalidNonceException Message: IDX21323: RequireNonce is '[PII is hidden]'. OpenIdConnectProtocolValidationContext.Nonce was null, OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was not null. The nonce cannot be validated. If you don't need to check the nonce, set OpenIdConnectProtocolValidator.RequireNonce to 'false'. Note if a 'nonce' is found it will be evaluated. Source: Microsoft.IdentityModel.Protocols.OpenIdConnect
The only mention I can find for this is on the Sitecore community site. However, it is not clear to me at least what the solution is here. It seems this is a none issue with Microsoft OWIN but to solve this and get Azure AD working with Sitecore Identity server requires adding a 3rd party NuGet solution? That does not smell right to me and I figured some of you out there have to have this working yes? So if the OWIN assembly that gets installed with Sitecore 9.1.1 does not work with Azure AD federation what did you all do?
I have removed all our custom pipeline code from the solution.
Update 4/16 Did a little more digging and I think the error I found was old or at least misleading. If I log in as an admin I can see a user was created with the random naming Sitecore does. If I assign a role to that user I can now log in. So it seems the mapping for the security group to role or isAdmin is not working.
Here is what that config looks like
<AzureADUserToAdminUser type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders"> <SourceClaims> <Claim1 type="groups" value="f67f9b7e-1db5-41f1-b761-3ca6b31f8d70" /> </SourceClaims> <NewClaims> <Claim1 type="http://www.sitecore.net/identity/claims/isAdmin" value="true"/> </NewClaims>
I have verified the I have verified (many times) the users belongs to the group and the app's manifest has "groupMembershipClaims": "SecurityGroup"