Add a Sitecore Custom User Profile Property to Identity Server Claim

Question

We are trying to understand how to customize the Sitecore Identity Server. We are using Sitecore 9.3.

Based on this article, by default, there are 5 claims available from Sitecore:

• name
• email
• role
• http://www.sitecore.net/identity/claims/isAdmin
• http://www.sitecore.net/identity/claims/originalIssuer

In Sitecore, we have many custom user profile properties such as first name, middle name,last name, gender, etc.

We would like to know how to include these custom user profile properties as part of the claims in the Identity Server. Is there any configuration that we need to add or modify or do we need to create a custom Identity Server provider?

We already tried this solution to try to add the default Sitecore user profile (for example comment field) to the Identity Server claim

but it still does not work.

Below are our identityServer.xml config:

<IdentityResources>
    <SitecoreIdentityResource>
      <Name>sitecore.profile</Name>
      <UserClaims>
        <UserClaim1>name</UserClaim1>
        <UserClaim2>email</UserClaim2>
        <UserClaim3>role</UserClaim3>
        <UserClaim4>http://www.sitecore.net/identity/claims/isAdmin</UserClaim4>
        <UserClaim5>http://www.sitecore.net/identity/claims/originalIssuer</UserClaim5>
        <UserClaim6>comment</UserClaim6>
      </UserClaims>
      <Required>true</Required>
    </SitecoreIdentityResource>
  </IdentityResources>
...
<ExternalIdentityProviders>
  <IdentityProviders>
    <IdentityServer type="Sitecore.Plugin.IdentityProviders.IdentityProvider, Sitecore.Plugin.IdentityProviders">
      <AuthenticationScheme>idsvr</AuthenticationScheme>
      <DisplayName>Identity Server</DisplayName>
      <ClaimsTransformations>
        <ClaimsTransformation1 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
          <SourceClaims>
            <Claim1 type="Comment" />
          </SourceClaims>
          <NewClaims>
            <Claim1 type="comment" />
          </NewClaims>
        </ClaimsTransformation1>
      </ClaimsTransformations>
    </IdentityServer>
  </IdentityProviders>
</ExternalIdentityProviders>

and our Sitecore.Owin.Authentication.IdentityServer.config

<propertyInitializer>
    <maps>
      <map name="set IsAdministrator" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication" resolve="true">
        <data hint="raw:AddData">
          <source name="http://www.sitecore.net/identity/claims/isAdmin" value="true" />
          <target name="IsAdministrator" value="true" />
        </data>
      </map>
      <map name="set Comment" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication" resolve="true">
        <data hint="raw:AddData">
          <source name="comment" />
          <target name="Comment" />
        </data>
      </map>
    </maps>
  </propertyInitializer>

Answer 1

Looking at your identityServer.xml file, I can see you are applying claim transformations against the default IdentityProvider - denoted by idsvr. This default provider logs in with username/password against the core or the security database (which the sitecore instance has access too - so there is no need to transform data).

Identity server acts as a gateway to other sub providers. When you use one of these sub providers (for example Azure AD), you configure which claims to send on successful login (in Azure AD - this is done with Manifest). This might include first and surname for example.

It is in this situation, that you should use claim transformations to match the incoming claim against on of the default (or custom) attributes in the sitecore.profile identity. This identity is then sent to the sitecore instance and the property initializer uses the incoming data to map against the sitecore user profile being created.

Therefore, it is my opinion that the reason that you are not getting any value showing against the comment on the profile, is because a 'comment' claim does not exist currently on idsvr identity provider. To test this out, you could try hard coding a value to pass - this will test that your config on the sitecore side is working.

Try using one of the existing claims and map to a value:

<ClaimsTransformation1 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
  <SourceClaims>
    <Claim1 type="Email" />
  </SourceClaims>
  <NewClaims>
    <Claim1 type="comment" value="HARD CODED COMMENT" />
  </NewClaims>
</ClaimsTransformation1>

The topic of the first article you link to in your question, looks at using Azure AD as a sub provider. If you have indeed followed that and setup azure as a sub provider. Then I suspect that you have placed your transformations in the wrong place.

They should be here:

<IdentityProviders>
  <AzureAd type="Sitecore.Plugin.IdentityProviders.IdentityProvider, Sitecore.Plugin.IdentityProviders">
    <AuthenticationScheme>IdS4-AzureAd</AuthenticationScheme>
        <ClaimsTransformations>
            ....... HERE .........

One last point. A utility that I found useful when tracking claims passing through identity server was called SIsnitch. By adding the DLL to you sitecore solution, you can see in the logs which claims have been pased through:

https://github.com/KayeeNL/SI-Snitch