0

I am new to Sitecore Azure AD authentication setup. So I had followed the link (https://www.velir.com/blog/2019/07/01/integrating-identity-server-azure-active-directory-single-sign-sso-sitecore-91) to set up Azure AD owin authentication in Sitecore. Everything is working fine now.

Since I am following the persistent user creation process, now the client is asking to create only specific Azure AD security group members, if they do not exist in Sitecore back office. Currently, we are creating all the users who are present in Azure AD.

So could anyone help me how to restrict the user creation only based on a certain Azure AD group?

Below is my claims transformation configured in AzureAd.xml

 <ClaimsTransformations>
        <!--Place transformation rules here. -->
        <ClaimsTransformation1 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
          <SourceClaims>
            <Claim1 type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" />
          </SourceClaims>
          <NewClaims>
            <Claim1 type="email" />
          </NewClaims>
        </ClaimsTransformation1 >
        <ClaimsTransformation2 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
          <SourceClaims>
            <Claim1 type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
          </SourceClaims>
          <NewClaims>
            <Claim1 type="name" />
          </NewClaims>
        </ClaimsTransformation2>
        <AzureADUserToAdminUser1 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
                <SourceClaims>
                  <Claim1 type="groups" value="420bttyc-8c0d-4c3e-a8df-30a4cea08f68" />
                </SourceClaims>
                <NewClaims>
                  <Claim1 type="role" value="sitecore\Sitecore Client Users" />
                </NewClaims>
              </AzureADUserToAdminUser1>
 </ClaimsTransformations>

Also Using CustomExternalUserBuilder for Unique username creation.

Improve this question
3
  • Can you provide details of your ClaimsTransformations within the Sitecore.Plugin.IdentityProvider.AzureAd.xml' config file ? Are you using the default DefaultExternalUserBuilder ` or a custom one. To meet you requirements, you will need to add custom logic in your implementation of ExternalUserBuilder. You may consider reviewing my blog too 360agileweb.wordpress.com/2020/02/28/sitecore-host-part-three for extra pointers
    – Julius A
    Commented Nov 25, 2020 at 12:15
  • updated my ClaimsTransformations in question. Please check.
    – Prabhu Ranganathan
    Commented Nov 26, 2020 at 6:59
  • Looks like you are restricting adding to role based on azure AD group in <AzureADUserToAdminUser1>. Can you not just restrict access to only those in that role? If you must stop role creation, then can you not check for that role in customexternaluserbuilder and stop process there if not present?
    – Dean OBrien
    Commented Aug 20, 2022 at 9:00

1 Answer 1

Reset to default
0

Because you have now chosen to use Azure AD with your Sitecore Identity, Azure AD effectively becomes the single source of truth for your User Management. This is the whole point of configuring an external provider for Sitecore Identity as a Federation Gateway.

I will recommend to instead audit your Sitecore back office and clean up any existing local users corresponding to your Azure AD. Remember Azure AD is now responsible for the authentication and you no longer need to manage the same user twice in Sitecore. Your ClaimsTransformations section should define claim mappings to address Sitecore user mappings and Sirecore role assignments to meet your requirements.

Run the following query on against your Core DB to see full list of users:

SELECT U.* FROM aspnet_Users as U
JOIN aspnet_Membership as M on U.UserId = M.UserId
Improve this answer
5
  • How will this help me to restrict the user creation process?
    – Prabhu Ranganathan
    Commented Nov 26, 2020 at 10:53
  • If I understood your use case well, I recommend you change your solution to reflect the use of Azure AD provider as your single source of truth for users. You will need users being driven from Azure AD and not restrict them, which will be incongruous
    – Julius A
    Commented Nov 26, 2020 at 11:50
  • Azure AD is our single source of truth for the user already. But now I was asked to restrict only certain Azure AD group members will access the system and they don't even want to create other group of users in the Sitecore back office.
    – Prabhu Ranganathan
    Commented Nov 26, 2020 at 11:57
  • I will suggest you then instead create a new group in Azure AD which will have all the users that you need to access Sitecore. Then map this newly created Azure AD group instead of the current one<Claim1 type="groups" value="420bttyc-8c0d-4c3e-a8df-30a4cea08f68" />
    – Julius A
    Commented Nov 26, 2020 at 16:30
  • 1
    I had followed that already but this ClaimsTransformation will not stop creating other group users in Sitecore. Other group users will be created and no access when we use this. But I need even stop creating user from other groups. I realize it would be possible with ExternalUserBuilder. Let me try and keep you updated. Thanks for all your efforts on this.
    – Prabhu Ranganathan
    Commented Nov 27, 2020 at 4:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.