User roles are being removed following Active Directory (AD) login in Sitecore 10.1.3
Our website operated initially on Sitecore 10.1.1. However, driven by the imperative of addressing particular hotfixes, we made the proactive choice to upgrade it to Sitecore 10.1.3. Following the upgrade, a significant issue arose: when users logged in through Active Directory (AD), their roles were removed within Sitecore. Consequently, this loss of roles led to a subsequent challenge where affected users were unable to log in again, as their roles were essential for access privileges.
To solve this issue, we have raised a Sitecore support ticket and Sitecore suggested below solution:
I reproduced and fixed the issue in my local environment in the following way:
1. Install Sitecore 10.1.1.
2. Configure custom Azure AD identity provider on CM.
3. Add a Sitecore role (e.g. “sitecore\Forms Editor”) to an Azure AD user in User Manager.
4. Install Sitecore 10.1.3 rev. 009359 PRE.
5. Login using an Azure AD user.
In this case, the defined role in the 3rd step is removed.
6. Add the following section to the custom Azure AD identity provider’ definition in the configuration:
<clearroleswhensignin>false</clearroleswhensignin>
7. Repeat the 3rd step.
8. Log in using an Azure AD user.
In this case, the defined role on the 7th step is not removed.
I see that your “keycloak” identity provider is defined in the “\App_Config\Include\XXXX\FederatedAuthenticationSettings.config” file.
The <clearroleswhensignin>false</clearroleswhensignin> section is missing under the following node:
<identityProvider id="keycloak" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication">
I see that this section is only added under the out of the box “SitecoreIdentityServer” identity provider’s node:
<identityProvider id="SitecoreIdentityServer" type="Sitecore.Owin.Authentication.IdentityServer.IdentityServerProvider, Sitecore.Owin.Authentication.IdentityServer" resolve="true" patch:source="Sitecore.Owin.Authentication.IdentityServer.Disabler.config">
So, to resolve the issue, please update the configuration of the “\App_Config\Include\XXXX\FederatedAuthenticationSettings.config” file as follows:
<identityProvider id="keycloak" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication">
<param desc="name">$(id)</param>
<param desc="domainManager" type="Sitecore.Abstractions.BaseDomainManager" resolve="true" />
<caption>Log in with keycloak</caption>
<icon>/sitecore/shell/themes/standard/Custom/24x24/msazure.png</icon>
<domain>sitecore</domain>
<enabled>true</enabled>
<clearroleswhensignin>false</clearroleswhensignin>
<transformations hint="list:AddTransformation">
<transformation type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="groups" value="SitecoreAdmin" />
</sources>
<targets hint="raw:AddTarget">
<claim name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" value="Sitecore\Developer" />
</targets>
<keepSource>true</keepSource>
</transformation>
</transformations>
</identityProvider>
In this case, the behavior should be the same as it was in your Sitecore 10.1.1 instance.
However, the already removed roles should be added again to the affected users.
An alternative approach is to use the “Sitecore.Owin.Authentication.dll” assembly that has version 6.0.1.0 from Sitecore 10.1.1 instead of version 6.0.11.0 in your current affected instance.
I hope this will help you as well.
Comments