can role mapping with Sitecore can be done with Email ID using Configuration?

Question

We are working on Sitecore 9.2 and need to implement Federated authentication with Azure AD where we will process returned claim, which will return an email, and based on that email we need to check if the user exists in Core db and assign the respective role to user.

Question here is, can role mapping with Sitecore can be done with Email using Configuration or this needs custom Processor.

Answer 1

You will need a combination of configuration and code for this I believe. Sitecore's built-in "User Name Generator" does not use the Email or SPN claim from AzureAD for creating user accounts. Sadly it generates a sort of hash value that causes a number of downstream problems for authors:

• Item is locked by sitecore\cUfswe4ks
• Workflow emails notify approvers that sitecore\fdsjiwefr just updated an item
• Too many authors logged in? Do you kick gdhsursdk or fhsdfsn?

The intent here appears to have been to ensure uniqueness, but this is just unusable really. We use the class below to keep the 'hash' but add the user's name back in:

using Microsoft.AspNet.Identity;
using Microsoft.AspNet.Identity.Owin;
using Sitecore.Owin.Authentication.Identity;
using Sitecore.Owin.Authentication.Services;
using Sitecore.SecurityModel.Cryptography;

public class MyExternalUserBuilder : DefaultExternalUserBuilder
{
    public MyExternalUserBuilder( ApplicationUserFactory applicationUserFactory, IHashEncryption hashEncryption ) : base( applicationUserFactory, hashEncryption ) { }

    protected override string CreateUniqueUserName( UserManager<ApplicationUser> userManager, ExternalLoginInfo externalLoginInfo )
    {
        var defaultName = base.CreateUniqueUserName( userManager, externalLoginInfo );
        var name = externalLoginInfo?.ExternalIdentity?.Name ?? "";

        return $"{defaultName}-{name}";
    }
}

Pretty simple - just take the existing generated name and whack the real name on the end.

You would need to do something similar but replace the calculated name with the value from the SPN claim (or Email). The your users will get the name sitecore\<email address>.

Beware though: the user accounts are persisted in the Core DB, but the role assignments are not, by default. I don't know if any existing assigned roles are automatically removed during login and replaced with the newly mapped in ones from AAD - you'd need to experiment a bit with that.

Answer 2

We were able to associate Sitecore with claims by overriding the Transformation Pipeline like this here are the steps

1)

public class CustomRoleTransformation : DefaultTransformation
    {

    public override void Transform(ClaimsIdentity identity, TransformationContext context)
        {

2) // Loop through all the claims and get all the roles for existing user

3) Create the ClaimRoles List
List lstClaimRoles = new List();

4) Then add roles to claims lstClaimRoles.Add(new Claim(ClaimsIdentity.DefaultRoleClaimType, role.Name));

5) identity.AddClaims(lstClaimRoles);