0

We are looking for a process in which some very basic role is granted to users that allow them to purely login to Sitecore, followed by a more traditional process of manually granting access to the user from within the Sitecore Role Manager.

Can this be handled through configuration or custom code? From within Sitecore or Identity Server?

2 Answers 2

1

I was able to accomplish this through code changes deployed to the Sitecore CM instance.

Begin by adding a new class for role transformation. Regardless of the existing roles included with the claim, only the Sitecore\Sitecore Client Users is needed for granting users enough access to see the Launchpad.

using System.Security.Claims;
using Sitecore.Owin.Authentication.Services;

namespace Company.Feature.Security.Transformations
{
    public class AddDefaultRoles : Transformation
    {
        public override void Transform(ClaimsIdentity identity, TransformationContext context)
        {
            foreach (var claim in identity.FindAll("role"))
            {
                identity.RemoveClaim(claim);
            }
            
            identity.AddClaim(new Claim(ClaimTypes.Role, $"Sitecore\\Sitecore Client Users"));
        }
    }
}

Next you'll need a configuration to patch this into Sitecore.

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:set="http://www.sitecore.net/xmlconfig/set/" xmlns:role="http://www.sitecore.net/xmlconfig/role/">
  <sitecore role:require="Standalone or ContentManagement">
    <federatedAuthentication>
      <identityProviders>
        <identityProvider id="SitecoreIdentityServer">
          <transformations>
            <transformation name="grant minimal roles" type="Company.Feature.Security.Transformations.AddDefaultRoles, Company.Feature" resolve="true" patch:after="transformation[@name='name to long name']" />
          </transformations>
        </identityProvider>
      </identityProviders>
    </federatedAuthentication>
  </sitecore>
</configuration>

Once the user logs in with the "Login with Azure" or "Login with ADFS" button you've added to Identity Server, they'll be presented with this after login.

Default Launchpad

Note: Only roles added through the Role Manager will be visible or accessible through the Sitecore API.

0

On Sitecore 9.2 CM and ADFS were able to achieve this via Role claims as attached. Over here group claim refresh to the user group of the ADFS

enter image description here

For Full config : https://github.com/naga-bethu/Sitecore/blob/main/A.adfs.config

1
  • Can you provide a more complete XML snippet and add it to the answer? Screenshots of partial code/config samples may be difficult for others to use. Commented May 5, 2022 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.