We are replacing our native Sitecore authorization and user management in our customer portal with Azure AD. We would like Azure AD to also provide some profile data (we will probably extend the schema), as well as controlling membership of Sitecore security roles based on a combination of Azure AD group membership and profile data. Our aim is to operate with virtual users, with an extremely limited shadow in Sitecore where necessary (e.g. some application preferences).
Our requirements include:
- Support for multiple domains (e.g. ourcompany.com, ourcompany.dk, ourcompany.de)
- Server side connection to external web services (probably RESTful) that are protected by the same Azure AD authorization and provide user specific data
- Client side connection to these same services (e.g. as an AJAX request) from within Sitecore pages
- Single Sign On (log in to all sites/services one-time) would be nice to have, seamless experience of the data feeds in point 3 is essential.
- Execute business logic on log-in to determine which Sitecore security roles an authorized acount should belong to
While we wait for Azure AD to be integrated into Sitecore 8.3 (according to the road map) there are numerous approaches available, and various modules/code examples provided.
To quickly list a few options:
- Using Azure AD domain services to clip into the Sitecore AD module
- Using Azure AD B2C with OAUTH
- Using the ADFS module
- Using the OWIN federated indentity module
What are the most robust approaches/technologies (provide flexibility, transparency of implementation and management, minimal workarounds/hacks, open-endedness) for implementing an architecture that supports this?
What are the typical challenges we can expect to face with them?
