How to get a custom claim data back from Sitecore Identity server

Question

I am working with Sitecore 9.3 and SitecoreIdentity Server 7

I have created a custom claim in an Okta authorization server called user_login, this value appears when I preview the token in the tool found in Okta. I have also set this claim to be returned in the default scope as well as a custom scope.

However when I try and get the value to pass to sitecore I cannot see it appear in the list of claims.

What do I need to add to the identity server & sitecore config files to get this value to come through? The documentation does not really provide any clear ideas on how to achieve this...

Answer 1

In order to pass a custom claim back to sitecore, you need to first make sure that it added to the sitecore.profile. You can patch this by adding a copy of IdentityServer.xml into the relevant sub folder in sitecoreruntime folder.

Example:

<IdentityResources>
    <SitecoreIdentityResource>
      <Name>sitecore.profile</Name>
      <UserClaims>
        <UserClaim1>name</UserClaim1>
        <UserClaim2>email</UserClaim2>
        <UserClaim3>role</UserClaim3>
        <UserClaim4>http://www.sitecore.net/identity/claims/isAdmin</UserClaim4>
        <UserClaim5>http://www.sitecore.net/identity/claims/originalIssuer</UserClaim5>
        <UserClaim6>comment</UserClaim6>
        <UserClaim7>user_login</UserClaim7>
      </UserClaims>
      <Required>true</Required>
    </SitecoreIdentityResource>
</IdentityResources>

You then need to map the incoming claim from your identity provider to the claim in sitecore.profile. You do this by adding to the ClaimsTransformations block in the config file that defines your identity provider.

The example below is for AzureAD, but im guessing you would have something similar for Okta:

<Settings>
  <Sitecore>
    <ExternalIdentityProviders>
      <IdentityProviders>
        <AzureAd type="Sitecore.Plugin.IdentityProviders.IdentityProvider, Sitecore.Plugin.IdentityProviders">
          <AuthenticationScheme>IdS4-AzureAd</AuthenticationScheme>
          <DisplayName>Azure AD</DisplayName>
          <Enabled>true</Enabled>
          <ClientId>xxx</ClientId>
          <TenantId>xxx</TenantId>
          <MetadataAddress></MetadataAddress>
          <ClaimsTransformations>  
            ... other claims ...
            <customClaimMapping type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
              <SourceClaims>
                <Claim1 type="user_login" />
              </SourceClaims>
              <NewClaims>
                <Claim1 type="user_login" />
              </NewClaims>
            </customClaimMapping>
            ... other claims ...
          </ClaimsTransformations>
        </AzureAd>
      </IdentityProviders>
    </ExternalIdentityProviders>
  </Sitecore>
</Settings>

Once you have the above setup, I then recommend using a tool such as SI Snitch to confirm exactly what claims are reaching sitecore.

SI Snitch: https://github.com/KayeeNL/SI-Snitch