1

I configured my local Sitecore instance to use AAD to login and everything seems okay except that my name and my email is not populated in the newly created user in Sitecore, but it correctly mapped my group to Admin.

Here is what I see in login: enter image description here

In User Manager: enter image description here

Here is my name and email transformation:

<ClaimsTransformation1 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
                            <SourceClaims>
                                <Claim1 type="name"/>
                            </SourceClaims>
                            <NewClaims>
                                <Claim1 type="name"/>
                            </NewClaims>
                        </ClaimsTransformation1>
                        <ClaimsTransformation2 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
                            <SourceClaims>
                                <Claim1 type="verified_primary_email"/>
                            </SourceClaims>
                            <NewClaims>
                                <Claim1 type="email"/>
                            </NewClaims>
                        </ClaimsTransformation2>

I developed another web app to get all claims: enter image description here

Can someone point me how to make the claim mapping work for Full name and Email?

2 Answers 2

2

You can add the transformations for the email and name as below in the Azure AD config.

<ClaimsTransformations>
  <ActiveDirectoryEmailTransformation type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
     <SourceClaims>
          <Claim1 type="verified_primary_email"/>
     </SourceClaims>
     <NewClaims>
         <Claim1 type="email"/>
     </NewClaims>
  </ActiveDirectoryEmailTransformation>
  <ActiveDirectoryNameTransformation type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
      <SourceClaims>
          <Claim1 type="name"/>
      </SourceClaims>
      <NewClaims>
          <Claim1 type="name"/>
      </NewClaims>
   </ActiveDirectoryNameTransformation>
</ClaimsTransformations>

You can refer below blog post for more details:

https://sitecore.merkle.com/sitecore-identity-server-in-a-nutshell

Hope this helps!!!

1
  • That was for custom identity provider identitProvider.Adfs.xml he created. I am using existing provider \identityserver.dev.local\sitecore\Sitecore.Plugin.IdentityProvider.AzureAd
    – John Lee
    Commented May 25 at 14:31
0

Thanks ckhanna who pointed out an excellent article, the problem was not the claim mapping on the identity server side, it is at the Sitecore instance side.

if you look at the Siecore.Owin.Authentication.IdentityServer.config at Sitecore instance folder, there is only one map defined to set the administrator as shown here:

<propertyInitializer>
   <maps>
      <map name="set IsAdministrator" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication" resolve="true">
         <data hint="raw:AddData">
            <source name="http://www.sitecore.net/identity/claims/isAdmin" value="true"/>
            <target name="IsAdministrator" value="true"/>
        </data>
      </map>
   </maps>
</propertyInitializer>

That is why the Administrator attribute is set when the new user is created. I added two more maps there, deleted the user created earlier, and recycled Sitecore instance app pool, login again using AAD, the FullName and the email were both populated.

I think Sitecore sample missed those 2 maps.

The whole section should be shipped as follows:

<propertyInitializer>
    <maps>
        <map name="set IsAdministrator"
             type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication"
             resolve="true">
            <data hint="raw:AddData">
                <source name="http://www.sitecore.net/identity/claims/isAdmin"
                        value="true"/>
                <target name="IsAdministrator"
                        value="true"/>
            </data>
        </map>
        <map name="set Email"
             type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication"
             resolve="true">
            <data hint="raw:AddData">
                <source name="email"/>
                <target name="Email"/>
            </data>
        </map>
        <map name="set Full Name"
             type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication"
             resolve="true">
            <data hint="raw:AddData">
                <source name="name"/>
                <target name="FullName"/>
            </data>
        </map>
    </maps>
</propertyInitializer>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.