Sitecore Azure AD Integration

Question

I am trying with Azure AD integration in my Sitecore 10.2 XM. I am not able to find the official documents in the sitecore documentation. But i have followed the following blogs for this and it looks straight forward. But i am facing some difficulties in my case.

https://sitecorewithraman.wordpress.com/2021/01/01/sitecore-cms-azure-ad-integration/

https://nabeelafsar.medium.com/a-simple-guide-to-setting-up-sso-with-azure-ad-using-sitecore-7269b2d6d138

https://sitecore.derekc.net/setting-up-azure-active-directory-integration-with-sitecore-identity-server-sitecore-9-1/

I have done the following for this

• Created new app registration in Azure, After creation of app, go to authentication section and check the "ID tokens" checkbox
• Updated the maniffest "groupMembershipClaims" as "SecurityGroup"
• Updated the following parameters in the file Sitecore.Plugin.IdentityProvider.AzureAd.xml
  • ClientId
  • TenantID
  • true
  • Enabled the node "AzureADUserToAdminUser" and updated the newly created AD Group object ID and ensured that group has my id.

Logged into Sitecore, got the option "Azure AD" under the default login. when i click it redirected and i am able to login successfully with my AD credentials and getting the following error now. am i missing anything else?

I am getting the following line item from the IDS log file. what i have done is, Sitecore is in my local. AD details are my organization details and created the necessary app, group in my organization AD. Does this related to the permission issue between my local and organization AD?

2023-06-05T18:33:52.2891267-04:00 [INF] (Sitecore Identity/My Machine Name Here) Request origin "https://login.microsoftonline.com" does not have permission to access the resource.

Answer 1

• Go to the Azure portal and log in.
• Then go to Azure Active Directory -> App registrations.

• Next click on the New registration button.

• Fill name, supported account type, and redirect URI and click on register button.
• Now go to the Manifest tab and update groupMembershipClaims value to SecurityGroup.
• Go to the Authentication tab and check the ID tokens checkbox.
• Go to the Groups inside Azure Active Directory, and create a new group if you don't have already one.

• Make sure you have added members to Demo_Admin group.
• Finally, go to the Overview tab and save the client Id and tenant Id which are going to be used in the Sitecore config later. Sitecore Identity Server Configuration
• Open inetpub\wwwroot\identityserverwebsite\sitecore\Sitecore.Plugin.IdentityProvider.AzureAd\Config\Sitecore.Plugin.IdentityProvider.AzureAd.xml and update ClientId and TenantId which was saved in previous step.

• Restart the Sitecore Identity Application and go to Sitecore Content Management to log in, now Azure AD button will be visible.
• Uncomment the below line from Sitecore.Plugin.IdentityProvider.AzureAd.xml and Copy the group id from Demo_Admin group and paste it. This I have done only for one group but it can be for multiple groups in a similar manner.

Sitecore Configuration

• Create patch file in code,

Now restart your identity website and go to content management URL and click on Azure AD.

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/" xmlns:set="http://www.sitecore.net/xmlconfig/set/">
    <sitecore role:require="Standalone or ContentManagement">
        <federatedAuthentication>
            <identityProviders>
                <identityProvider id="SitecoreIdentityServer/IdS4-AzureAd" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication">
                    <param desc="name">$(id)</param>
                    <param desc="domainManager" type="Sitecore.Abstractions.BaseDomainManager" resolve="true" />
                    <caption>Log in with Sitecore Identity: Azure AD</caption>
                    <icon>/sitecore/shell/themes/standard/Images/24x24/msazure.png</icon>
                    <domain>sitecore</domain>
                </identityProvider>
            </identityProviders>
            <propertyInitializer>
                <maps>
                    <map name="set Email" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication" resolve="true">
                        <data hint="raw:AddData">
                            <source name="email" />
                            <target name="Email" />
                        </data>
                    </map>
                    <map name="set FullName" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication" resolve="true">
                        <data hint="raw:AddData">
                            <source name="name" />
                            <target name="FullName" />
                        </data>
                    </map>
                </maps>
            </propertyInitializer>
        </federatedAuthentication>
    </sitecore>
</configuration>

More detail you can check here https://swatiguptablogs.blogspot.com/2022/10/azure-ad-integration-with-sitecore-102.html