How to remove a claim transformation programmatically from Sitecore Identity Server

Question

Our Sitecore 10.1.3 environment is hosted on Sitecore Managed Cloud.
In the current setup, when a CMS user tries to login into the CMS, using Azure AD, for the first time, it will be unsuccessful and they get redirected to the CMS login page. However, a user record is created which I can see in the CMS > User Manager.

To handle this, we are manually adding a claim in the ID server's Sitecore.Plugin.IdentityProvider.AzureAd.xml file like this:

<ClaimsTransformation2 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
  <SourceClaims>
    <Claim1 type="email" value="[email protected]" />
  </SourceClaims>
  <NewClaims>
    <Claim1 type="role" value="sitecore\Example Editor" />
    <Claim2 type="role" value="sitecore\Example Approver" />
  </NewClaims>
</ClaimsTransformation2>

Now the user can successfully login.

I would like to know, is it possible to programmatically remove a ClaimTransformation with email as input parameter.

If yes, could you please let me know how to get started on this. Can ID server be accessed from CD/CM server or Should I build a console app and host it on the ID server? How to test this on local instance?

UPDATE: To simply put, I wanted to know is there any existing API that I can call like https://my-sitecore-id-server.com/api/deleteuser
if no,should I build a console app. If yes, where to host it. Is it in the ID server?

Answer 1

On successful login, Azure AD send claims to Identity Server (IS). IS then takes those claims and maps them (using claims trabsformation config) to the SitecoreIdentityResource called Sitecore.Profile. The Sitecore.Profile resource is then sent to the Sitecore instance, where a new user is created (if it doesnt exist) using a propertyInitializer among other things.

I would like to know, is it possible to programmatically remove a ClaimTransformation with email as input parameter

The answer to this is no, the claims transformations only exist in the config files.

Sorry if I have misunderstood - if so please provide an example of exactly what you want to remove.

UPDATE

Another approach that you could consider, would be to create a new group in AzureAD - or find an existing group that all your target users might belong too. Then take the objectID of that group and apply a claims transformation using that.

Example below:

<AzureADUserToEditor type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
    <SourceClaims>
        <Claim1 type="groups" value="add-object-id-of-group-here" />
    </SourceClaims>
    <NewClaims>
        <Claim1 type="role" value="sitecore\Example Editor"/>
    </NewClaims>
</AzureADUserToEditor>

For this to work, you also need to edit the Manifest in azure (for the app registration linked to ID) and make sure groupMembershipClaims is set to SecurityGroup (or All) https://doc.sitecore.com/xp/en/developers/101/sitecore-experience-manager/use-the-sitecore-identity-server-as-a-federation-gateway.html#configure-azure-ad

Update 26/06/24

To answer this:

To simply put, I wanted to know is there any existing API that I can call like https://my-sitecore-id-server.com/api/deleteuser

This is not possible. Identity Server does not create or store users. This is done by the sitecore instance - therefore there cannot exist an API to delete a user, because Identity Server has no permission to do so.

You have said you are using Azure AD sub provider. In this situation, identity authenticates against Azure, then prepares all the claims and sends it to Sitecore. Sitecore then creates the user in either the core (or security) database (aspnet_Users table).

Identity server has access to a core database, but this is only for the old ASP membership login. You can test this out by adding a vanilla core DB and connecting it to identity server. You will see that azure authentication still works, but no info is stored in the vanilla DB.

Also, sitecore does not store any of the role assignments that have been created via the claims in your transformations (i.e. "sitecore\Example Editor"). These are stored as cookies and are only available for the length of the session.

See: Virtual and Persistent Users here

If you manually delete a user from the sitecore core database. When the same person logs in again, they are given the same username - this is because the creation process takes a hash of the users details.

Its worth noting, you can manually assign roles to a user (via role manager) that has been created via Azure and they will be stored in the sitecore core DB. These are the only roles that you could then delete. To remove a role set by identity server, you simply dont make the transformation in the first place.

Answer 2

You can use following code to remove the claim from the Context User inside Sitecore.

using System.Security.Claims;
using System.Linq;

var user = Sitecore.Context.User;
var claimIdentity = user.Identity as ClaimsIdentity;
var claim = claimIdentity.Claims.Where(x => x.Type == "{{ClaimType}}")?.FirstOrDefault();
if (claim != null)
{
     claimIdentity.RemoveClaim(claim);
}

Note: The claim you are trying to remove should be there on ClaimIdentity.Claims property, this property exposes all the claims available for the user.

Hope this helps!!!