2

I followed the this link to enable Azure AD as identity provider for my local Sitecore 10.1.3 instance. I can login with one of the user with admin groups mapped, but Sitecore gave me the following message:

enter image description here

it seems that the groups are not mapped to either admin or sitecore\author role. I developed a MVC app and verified that all groups of this user exist in the claim.

How do I troubleshoot this scenario? is there a way to know what claims send back to Sitecore identity server and how the map is done?

[Added new info] In the log of identity server, there are some INFO not error like this:

2024-03-07T10:39:57.5610869-08:00 [INF] (Sitecore Identity/DEMO-SC101) Request starting HTTP/1.1 POST http://xp0identityserver.dev.local/signin-oidc application/x-www-form-urlencoded 2257
2024-03-07T10:39:57.5634166-08:00 [INF] (Sitecore Identity/DEMO-SC101) CORS policy execution failed.
2024-03-07T10:39:57.5635849-08:00 [INF] (Sitecore Identity/DEMO-SC101) Request origin "https://login.microsoftonline.com" does not have permission to access the resource.
2024-03-07T10:39:57.5637415-08:00 [INF] (Sitecore Identity/DEMO-SC101) No CORS policy found for the specified request.

[NEW] looks like login as user that was admin group, the admin flag will be set. but those users with content authors group, the role = "sitecore\author" is not set. even I manually add role "sitecore\author", after that user login, the role was removed.

                        <AzureGroupTransformation type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
                            <SourceClaims>
                                <Claim1 type="groups" value="ba3a4750-1165-4082-bd3e-21d69d354f8c"/>
                            </SourceClaims>
                            <NewClaims>
                                <Claim1 type="role" value="sitecore\Author"/>
                                <Claim2 type="comment" />
                            </NewClaims>
                        </AzureGroupTransformation>

[Issue resolved] After add CORS origins and added comment claim to role map, magically everything works now.

Thank you very much! John

1
  • can you add the xml file which is doing the mapping between the roles from SC and Azure AD groups? Mar 7 at 16:38

2 Answers 2

1

Can you please verify your custom claims:

 <IdentityResources>
    <SitecoreIdentityResource>
        <Name>sitecore.profile</Name>
        <UserClaims>
            <UserClaim1>name</UserClaim1>
            <UserClaim2>email</UserClaim2>
            <UserClaim3>role</UserClaim3>
            <UserClaim4>http://www.sitecore.net/identity/claims/isAdmin</UserClaim4>
            <UserClaim5>http://www.sitecore.net/identity/claims/originalIssuer</UserClaim5>
            <UserClaim6>comment</UserClaim6>
            <UserClaim7>fullName</UserClaim7>
        </UserClaims>
        <Required>true</Required>
    </SitecoreIdentityResource>
</IdentityResources>

Also please verify the following configuration:

<ActiveDirectoryGroupTransformationAdmin type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
    <SourceClaims>
        <Claim1 type="http://schemas.microsoft.com/ws/2008/06/identity/claims/group" value="Sitecore_Admin"/>
    </SourceClaims>
    <NewClaims>
        <Claim1 type="http://www.sitecore.net/identity/claims/isAdmin" value="true"/>
        <Claim2 type="comment"/>
    </NewClaims>
</ActiveDirectoryGroupTransformationAdmin>

From your logs of the identity server info it seems like this:

You are missing some AllowedCorsOrigins settings in the Identity Server Allowed Cors Origins setting.

See the blog post for more details: Sitecore Identity Server in a nutshell

2
  • Thank you very much! just found out that if a user is part of admin group, that map works but map to sitecore\author does not work. even I manually add role to an AD user, after login, the roles added were all removed.
    – John
    Mar 8 at 6:35
  • where do I inspect the comment claim?
    – John
    Mar 8 at 6:41
0

Inside the file identityfolder/sitecore/Sitecore.Plugin.IdentityProvider.AzureAd/Config/Sitecore.Plugin.IdentityProvider.AzureAd.xml you need to have next configuration for admin group users:

<AzureADUserToAdminUser type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
  <SourceClaims>
    <Claim1 type="groups" value="aaa8caa0-aa32-46f0-1222-12cad423948d"/>
  </SourceClaims>
  <NewClaims>
      <Claim1 type="http://www.sitecore.net/identity/claims/isAdmin" value="true"/>
  </NewClaims>
</AzureADUserToAdminUser>

The id represent the ObjectID of AzureAD admin group

1
  • I have that settings changed
    – John
    Mar 7 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.