3

I am trying with Azure AD integration in my Sitecore 10.2 XM. I am not able to find the official documents in the sitecore documentation. But i have followed the following blogs for this and it looks straight forward. But i am facing some difficulties in my case.

https://sitecorewithraman.wordpress.com/2021/01/01/sitecore-cms-azure-ad-integration/

https://nabeelafsar.medium.com/a-simple-guide-to-setting-up-sso-with-azure-ad-using-sitecore-7269b2d6d138

https://sitecore.derekc.net/setting-up-azure-active-directory-integration-with-sitecore-identity-server-sitecore-9-1/

I have done the following for this

  • Created new app registration in Azure, After creation of app, go to authentication section and check the "ID tokens" checkbox
  • Updated the maniffest "groupMembershipClaims" as "SecurityGroup"
  • Updated the following parameters in the file Sitecore.Plugin.IdentityProvider.AzureAd.xml
    • ClientId
    • TenantID
    • true
    • Enabled the node "AzureADUserToAdminUser" and updated the newly created AD Group object ID and ensured that group has my id.

Logged into Sitecore, got the option "Azure AD" under the default login. when i click it redirected and i am able to login successfully with my AD credentials and getting the following error now. am i missing anything else?

enter image description here

I am getting the following line item from the IDS log file. what i have done is, Sitecore is in my local. AD details are my organization details and created the necessary app, group in my organization AD. Does this related to the permission issue between my local and organization AD?

2023-06-05T18:33:52.2891267-04:00 [INF] (Sitecore Identity/My Machine Name Here) Request origin "https://login.microsoftonline.com" does not have permission to access the resource.
6
  • Did you give the correct URL of the Sitecore identity server URL (append /signin-oidc) in the ‘Redirect URI’ field? Commented Jun 6, 2023 at 5:30
  • Yes, i have provided the correct URL, it's redirected me to ADO sing in page. Once i provided the credentials, then i get the above attached screen.
    – Jey
    Commented Jun 6, 2023 at 12:35
  • It's working fine for me now. The issue was "Permission" issue between my local IDS site and AD.
    – Jey
    Commented Jun 6, 2023 at 17:18
  • I have few questions if anyone can help with that. 1. Do we have the official doc for this in sitecore doc portal? 2. When i enable the Azure AD, Is that enough to add the users in AD alone? 3. If yes to my 2nd question, how to manage the different roles/permission in sitecore along with AD integration in place? 4. Can i disable the identity server login page when AD is in place?
    – Jey
    Commented Jun 6, 2023 at 17:22
  • I could not comment and writing my question as an answer - You said you resolved it as it was a permission issue between IDS site and AD. Would you please mind explaining that because I am stuck at the exact issue? Thank you
    – Saurav
    Commented Mar 22 at 0:19

1 Answer 1

4
  • Go to the Azure portal and log in.
  • Then go to Azure Active Directory -> App registrations.

enter image description here

  • Next click on the New registration button.

enter image description here

  • Fill name, supported account type, and redirect URI and click on register button. enter image description here
  • Now go to the Manifest tab and update groupMembershipClaims value to SecurityGroup. enter image description here
  • Go to the Authentication tab and check the ID tokens checkbox. enter image description here
  • Go to the Groups inside Azure Active Directory, and create a new group if you don't have already one. enter image description here

enter image description here

  • Make sure you have added members to Demo_Admin group.
  • Finally, go to the Overview tab and save the client Id and tenant Id which are going to be used in the Sitecore config later. enter image description here Sitecore Identity Server Configuration
  • Open inetpub\wwwroot\identityserverwebsite\sitecore\Sitecore.Plugin.IdentityProvider.AzureAd\Config\Sitecore.Plugin.IdentityProvider.AzureAd.xml and update ClientId and TenantId which was saved in previous step.

enter image description here

  • Restart the Sitecore Identity Application and go to Sitecore Content Management to log in, now Azure AD button will be visible. enter image description here
  • Uncomment the below line from Sitecore.Plugin.IdentityProvider.AzureAd.xml and Copy the group id from Demo_Admin group and paste it. This I have done only for one group but it can be for multiple groups in a similar manner. enter image description here

Sitecore Configuration

  • Create patch file in code,

Now restart your identity website and go to content management URL and click on Azure AD.

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/" xmlns:set="http://www.sitecore.net/xmlconfig/set/">
    <sitecore role:require="Standalone or ContentManagement">
        <federatedAuthentication>
            <identityProviders>
                <identityProvider id="SitecoreIdentityServer/IdS4-AzureAd" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication">
                    <param desc="name">$(id)</param>
                    <param desc="domainManager" type="Sitecore.Abstractions.BaseDomainManager" resolve="true" />
                    <caption>Log in with Sitecore Identity: Azure AD</caption>
                    <icon>/sitecore/shell/themes/standard/Images/24x24/msazure.png</icon>
                    <domain>sitecore</domain>
                </identityProvider>
            </identityProviders>
            <propertyInitializer>
                <maps>
                    <map name="set Email" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication" resolve="true">
                        <data hint="raw:AddData">
                            <source name="email" />
                            <target name="Email" />
                        </data>
                    </map>
                    <map name="set FullName" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication" resolve="true">
                        <data hint="raw:AddData">
                            <source name="name" />
                            <target name="FullName" />
                        </data>
                    </map>
                </maps>
            </propertyInitializer>
        </federatedAuthentication>
    </sitecore>
</configuration>

More detail you can check here https://swatiguptablogs.blogspot.com/2022/10/azure-ad-integration-with-sitecore-102.html

1
  • Thanks Swati for the detailed steps. I have done everything except the patch config file you mentioned. I will try with that. But what's the purpose of the patch file? do we have these steps provided in official sitecore documentation?
    – Jey
    Commented Jun 6, 2023 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.