We are working on Sitecore 9.2 and need to implement Federated authentication with Azure AD where we will process returned claim, which will return an email, and based on that email we need to check if the user exists in Core db and assign the respective role to user.

Question here is, can role mapping with Sitecore can be done with Email using Configuration or this needs custom Processor.

2 Answers 2


You will need a combination of configuration and code for this I believe. Sitecore's built-in "User Name Generator" does not use the Email or SPN claim from AzureAD for creating user accounts. Sadly it generates a sort of hash value that causes a number of downstream problems for authors:

  • Item is locked by sitecore\cUfswe4ks
  • Workflow emails notify approvers that sitecore\fdsjiwefr just updated an item
  • Too many authors logged in? Do you kick gdhsursdk or fhsdfsn?

The intent here appears to have been to ensure uniqueness, but this is just unusable really. We use the class below to keep the 'hash' but add the user's name back in:

using Microsoft.AspNet.Identity;
using Microsoft.AspNet.Identity.Owin;
using Sitecore.Owin.Authentication.Identity;
using Sitecore.Owin.Authentication.Services;
using Sitecore.SecurityModel.Cryptography;

public class MyExternalUserBuilder : DefaultExternalUserBuilder
    public MyExternalUserBuilder( ApplicationUserFactory applicationUserFactory, IHashEncryption hashEncryption ) : base( applicationUserFactory, hashEncryption ) { }

    protected override string CreateUniqueUserName( UserManager<ApplicationUser> userManager, ExternalLoginInfo externalLoginInfo )
        var defaultName = base.CreateUniqueUserName( userManager, externalLoginInfo );
        var name = externalLoginInfo?.ExternalIdentity?.Name ?? "";

        return $"{defaultName}-{name}";

Pretty simple - just take the existing generated name and whack the real name on the end.

You would need to do something similar but replace the calculated name with the value from the SPN claim (or Email). The your users will get the name sitecore\<email address>.

Beware though: the user accounts are persisted in the Core DB, but the role assignments are not, by default. I don't know if any existing assigned roles are automatically removed during login and replaced with the newly mapped in ones from AAD - you'd need to experiment a bit with that.


We were able to associate Sitecore with claims by overriding the Transformation Pipeline like this here are the steps


public class CustomRoleTransformation : DefaultTransformation

    public override void Transform(ClaimsIdentity identity, TransformationContext context)

2) // Loop through all the claims and get all the roles for existing user

3) Create the ClaimRoles List
List lstClaimRoles = new List();

4) Then add roles to claims lstClaimRoles.Add(new Claim(ClaimsIdentity.DefaultRoleClaimType, role.Name));

5) identity.AddClaims(lstClaimRoles);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.