Contents
How to add Sitecore identity to Azure Active Directory?
This walkthrough assumes you’ve already installed Sitecore 9.1, Identity Server, and have Azure AD in place. Start by adding your Application to the approved applications in your Azure Active Directory instance. I’m using the preview version of the application interface, which looks like this:
How to create Federated authentication for Sitecore 9?
Step 1: Login to azure portal and click “New” and search for “Azure Active Directory” and click “Create” as shown below. Step 2: Provide the basic information like “Organization name”, domain name, country and click Create button as shown in below screen shot.
Who are the subjects and users of Sitecore?
Subject/User (Sitecore User): Subjects are the users who wish to access the resources of an organization using federated authentication/SSO. Identity Provider (Azure AD): Identity providers are those parties that authenticate users and issue token/claims to the relying party (SP).
How to map Active Directory to Sitecore roles?
You’ll need to map group membership in Active Directory to roles in Sitecore. For this walkthrough, we’re going to map a group in our Active Directory named “SitecoreAdmin”, which will become Administrators in our Sitecore instance.
How to get an Azure Active Directory token?
Get an Azure Active Directory access token. To get an access token, you can use either: Authorization code flow (interactive) Username-password flow (programmatic) You must use the authorization code flow to get the Azure AD access token if: Two factor authentication is enabled in Azure AD. Federated authentication is enabled in Azure AD.
How to enable ID tokens in Sitecore identity?
After creating the application, you’ll want to enable ID Tokens to be passed between AD and Sitecore Identity. Open your application, and visit the Authentication section. The checkbox to enable ID tokens is under the Advanced Settings: Next, lets visit the Manifest section.
Can you test Azure AD with username and password?
If users are full-page redirected to an on-premises identity providers, Azure AD is not able to test the username and password against that identity provider. Pass-through authentication is supported with ROPC, however. Try executing this request to obtain access token. Note :Microsoft recommends you do not use the ROPC flow.