Contents
How does Azure AD Federated authentication work for Sitecore?
In the context of Azure AD federated authentication for Sitecore, Azure AD (IDP/STS) issues claims and gives each claim one or more values. Sitecore reads the claims issued for an authenticated user during the external authentication process and allow access to perform Sitecore operations based on the role claim.
What happens if there is no Sitecore user identity?
At this point, there is still no Sitecore user identity. The result: The user gets redirected back to the login page, the authentication challenge will not be triggered, as the claims cookie is available. Right now we are are missing logic to do an actual “Sitecore user login”. There are bootstrap options to do this:
Who are the subjects and users of Sitecore?
Subject/User (Sitecore User): Subjects are the users who wish to access the resources of an organization using federated authentication/SSO. Identity Provider (Azure AD): Identity providers are those parties that authenticate users and issue token/claims to the relying party (SP).
Which is the default authentication provider for Sitecore?
The Sitecore architecture. Basically, the default user management implementation for Sitecore, is a custom Forms Authentication Provider, which makes use of the default ASP.Net Forms Authentication implementation. Under the hood, these users are partially managed in a standard Asp.Net Membership database.
How to map user profiles in Sitecore 9.1?
This is done by overriding the Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, and is outside the scope of this blog post. However, it’s far more likely that you just want a way to identify the users in your system – by mapping their names, e-mail addresses, or other information from the Identity Providing system.
Why should I map more claims in Sitecore?
Afterwards, Part 3 will walk you through setting up Claim Mapping Policies in Azure AD for mapping nonstandard and custom AD attributes. That post is available here. Why should I map more claims? Valid question! It could be that you’re perfectly happy mapping only the bare necessities and making everyone an administrator in Sitecore.
How to add Sitecore identity to Azure Active Directory?
This walkthrough assumes you’ve already installed Sitecore 9.1, Identity Server, and have Azure AD in place. Start by adding your Application to the approved applications in your Azure Active Directory instance. I’m using the preview version of the application interface, which looks like this:
Can you secure an intranet with Azure Active Directory?
Since this is an internal site one of the requirements was to secure all content using Azure Active Directory, keep in mind we are not talking about the Sitecore Client, but the actual site. So to sum up the challenge: Secure the intranet using Azure Active Directory while leaving the other two public sites available to all.