5

We are trying to implement AD and SSO in Sitecore 8.1. There is this specific requirement to not move all the AD users to Sitecore Profiles/DB as the list of AD users are huge. Rather we are planning to save & validate the users at the time of authentication and then use it for SSO. Please suggest any suitable approach to achieve this.

  • Are you able to use an AD query to limit the users/roles from AD to import into Sitecore? – Patrick Barron Mar 15 '17 at 15:29
  • Not sure how to use it.Can you explain? – Amitabh Mar 15 '17 at 15:39
  • Your connection string should point to the parent node of the logical group, then on the "system.web/memebership/providers" node you can add a "customFilter" attribute that can further limit the users/roles that will show up. The filter will be specific to how your AD groups are setup, but an example query would be something like "(memberOf=CN=Managers,DC=testdomain,DC=sitecore,DC=net)" – Patrick Barron Mar 15 '17 at 15:46
7

You have couple choices here:

1) You can use the SSO mechanism and then override the sitecore login pipeline to let the users login from your custom login screen. This will ensure only users who are validated via your sitecore login or custom sitecore login screen due to override in pipeline.

2) Sitecore AD connector does allow you to have multiple domains. So all you can do is create a domain with specific users whom you want to grant access and let them login to the sitecore. I have written this blogs https://mrunaldaftari.wordpress.com/2017/02/17/sc-and-active-directory-connecting-to-multiple-domains/ which may help you understand how exactly you can achieve this but for summary here are the steps you should take:

  • Work with the infrastructure team to get below things in place for each domains you want users to be allowed to login
  • Infrastructure team needs to create Organizational Unit
  • A domain controller using which you can connect to the the LDAP so can be any server.
  • For example This is the distinguished name of the OU that all of your stuff is in: OU=public LDAP Test,OU=User Accounts,DC=hq,DC=usernet,DC=com
  • User account and server to connect to the above settings.
  • Once you have all of the above your connection string may look like below: LDAP:/domaincontrollermachinname/OU=Public LDAP Test,OU=User Accounts,DC=domainname,DC=usernet,DC=com
  • User account and server to connect to the above settings
  • Once you have all of the above your connection string may look like below: LDAP:/domaincontrollermachinname/OU=Public LDAP Test,OU=User Accounts,DC=domainname,DC=usernet,DC=com

And you can keep repeating this steps for each domain and add them to the connection string to let them login.

Let me know if you need more details. This https://mrunaldaftari.wordpress.com/category/active-directory/ blog link have 5 related blogs which will help you get achieve what you need using AD module.

Update this is another step which you can look into for SSO https://mrunaldaftari.wordpress.com/2017/02/16/active-directory-and-sso-to-let-ad-users-login-to-the-sitecore/

|improve this answer|||||
  • I do not want to have AD roles or users to be added into Sitecore DB. I need to validate the AD users not in Sitecore before going for SSO. So that only validated users that are present in AD but not in Sitecore are allowed for SSO. Can we achieve this anyway? – Amitabh Mar 22 '17 at 7:07
-1

I had the same challenge back in Sitecore 6.6, we used cookies in order to implement SSO, however you can use Virtual User in Sitecore context, if you need to use Sitecore Roles for its context. I had to write custom ldap queries in order to search for users and its groups in AD, we only imported AD Groups into Sitecore Roles, and used VirtualUser, then generated secretToken and stored in cookies, which then been read by a different system in order to perform SSO.

|improve this answer|||||
  • Thanks Sergejs Kravcenko. It would be really helpful if you can describe how you achieved this. – Amitabh Mar 22 '17 at 7:15
  • That was about 10 years ago, I don't remember its implementation but it should be straight forward if you follow the sitecore documentation around Virtual User usage. – Sergey Kravchenko Jul 4 '19 at 15:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.