AEM-Azure AD SSO Integration fails if group count exceeds 150 in azure AD | Community
Skip to main content
nishaSharma
nishaSharma
Level 2
June 8, 2020
Solved

AEM-Azure AD SSO Integration fails if group count exceeds 150 in azure AD

  • June 8, 2020
  • 1 reply
  • 2279 views

Hello,

We have a usecase like:

We have integrated AEM SAML(OOTB) with Azure AD for user authentication. Now In Azure they have limitation that they can provide max of 150 groups(user belongs to) in saml response.
If a user is member of more than 150 groups for SAML, then Azure AD does not emit the groups claim in SAML Assertion. Instead it will replace the group attribute (usually named http://schemas.microsoft.com/claims/groups) with a group.link attribute (http://schemas.microsoft.com/claims/groups.link) that will contain a link back to https://graph.windows.net/<IdentityProviderID>/users/<UserObjectID>/getMemberObjects.
This causes the role mapping on the platform to be ineffective for the user the Assertion is applicable to.


User gets authenticated from azure but couldn't landed up with any AEM screen as saml response doesn't contain group information to redirect user to authorized page. Azure team says we need to call a REST Microsoft graph api to get group information in such case using that group.link.

We need to handle both scenarios:
1. User belongs to less than equal to 150 groups
2. User belongs to more than 150 groups

Can anyone suggest how we can achieve this? Do we need to write custom SAML authentication handler? how to call graph apis?

Quick response will be highly appreciated!!

 

Thanks in advance
Nisha

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by user05162

This will not work OOTB as AEM expects the "groups" attribute in the SAML response. You have 2 options for users with more than 150 groups:

 

1) Write a custom authentication handler to handle this scenario

2) Log a ticket with azure and have them increase the limit to more than 150

1 reply

U
Adobe Employee
user05162Adobe EmployeeAccepted solution
Adobe Employee
June 8, 2020

This will not work OOTB as AEM expects the "groups" attribute in the SAML response. You have 2 options for users with more than 150 groups:

 

1) Write a custom authentication handler to handle this scenario

2) Log a ticket with azure and have them increase the limit to more than 150

nishaSharma
nishaSharmaAuthor
Level 2
June 9, 2020

How can we handle both cases in custom saml handler:

1. Users with less than 150 groups: SAML response will have "group" attribute containing groups information

2. Users with more than 150 groups: SAML respnse will have "group.link" attribute containing graph api link to be called in order to fetch groups information

and how this group sync will work then in aem programmatically.

 

Can anyone help with sample custom saml handler code for this?

OR is there any other approach in aem to acheive this usecase?

Terms & ConditionsAccessibility statement

Loading footer...