1

Is it possible to have multiple roles when using Azure AD for federated authentication to the CMS? Currently testing this with Sitecore 9.3.

I want to be able to assign to the AD user either Public Web Author or Public Web Author + Developer. However Sitecore only seems to pick one of the roles.

Identity server:

<Sitecore>
  <ExternalIdentityProviders>
    <IdentityProviders>
      <AzureAd>
        <ClaimsTransformations>
          <AzureGroupTransformation type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
            <SourceClaims>
              <Claim1 type="groups" value="76a85c07-e51f-4c87-8568-3e21dc3b9dce" />
            </SourceClaims>
            <NewClaims>
              <Claim1 type="role" value="sitecore\Public Web Author" />
            </NewClaims>
          </AzureGroupTransformation>
          <AzureGroupTransformation type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
            <SourceClaims>
              <Claim1 type="groups" value="3064fb35-e2b9-4f9a-bdf7-7280e319fc52" />
            </SourceClaims>
            <NewClaims>
              <Claim1 type="role" value="sitecore\Developer" />
            </NewClaims>
          </AzureGroupTransformation>
          <AzureADUserToAdminUser type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
            <SourceClaims>
              <Claim1 type="groups" value="8af5e84c-d1f1-4f44-9a46-e168e197b0dc" /> 
            </SourceClaims>
            <NewClaims>
              <Claim1 type="http://www.sitecore.net/identity/claims/isAdmin" value="true"/>
            </NewClaims>
          </AzureADUserToAdminUser>
        </ClaimsTransformations>
      </AzureAd>
    </IdentityProviders>
  </ExternalIdentityProviders>
</Sitecore>
  • maybe try rename the Public Web Author role to one without spaces – Abhay Dhar Aug 24 at 14:42
1

I have a different scenario where I use 2 Azure AD groups to claim a single Sitecore Role, and it look like this

<AzureADToAuthor type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders" >
     <SourceClaims>
     <!-- Group 1 -->
          <Claim1 type="groups" value="d8aa7404-cc24-46dc-a66d-013cf52384e9" />
     <!-- Group 2 -->
          <Claim2 type="groups" value="d4215556-b598-4b1f-acd7-c9dfc52ccc61" />
     </SourceClaims>
     <NewClaims>
          <Claim1 type="role" value="Sitecore\Author" />
     </NewClaims> </AzureADToAuthor>

And I believe here is how you should do it in your case, and claim 2 Sitecore Roles instead

<AzureADToDevAuthor type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders" >
   <SourceClaims>
      <Claim1 type="groups" value="d8aa7404-cc24-46dc-a66d-013cf52384e9" />
   </SourceClaims>
   <NewClaims>
      <Claim1 type="role" value="sitecore\Public Web Author" />
      <Claim2 type="role" value="sitecore\Developer" />
   </NewClaims>
</AzureADToDevAuthor>
| improve this answer | |
  • I did consider this 2nd one, but it's not ideal as in our actual case we will need to create 16 new groups in AD to handle all the scenarios. – Mark Gibbons Aug 25 at 23:50
  • I updated the question since this answer, but its a good contribution. – Mark Gibbons Aug 26 at 2:19
1

On the documentation there are the following items:

When you configure and use Azure AD with the Sitecore Identity server, you have to remember:

  1. Check the ID tokens checkbox in the Advanced Settings in the Web - Authentication tab in the application registration.

  2. Set the value of the groupMembershipClaims setting in the application manifest to SecurityGroup.

  3. You can only configure replyUrls in the legacy version of the application registration. Use replyUrlsWithType instead.

We had not done number 2 - it was set to "All", so updated this, and also:

Do not add multiple nodes with the same name. If you need multiple nodes, name the nodes AzureGroupTransformation1, AzureGroupTransformation2, and so forth.

We had not done this. Updating these two changes resolved it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.