AEM-Azure AD SSO Integration fails if group count exceeds 150 in azure AD

nishaSharma

08-06-2020

Hello,

We have a usecase like:

We have integrated AEM SAML(OOTB) with Azure AD for user authentication. Now In Azure they have limitation that they can provide max of 150 groups(user belongs to) in saml response.
If a user is member of more than 150 groups for SAML, then Azure AD does not emit the groups claim in SAML Assertion. Instead it will replace the group attribute (usually named http://schemas.microsoft.com/claims/groups) with a group.link attribute (http://schemas.microsoft.com/claims/groups.link) that will contain a link back to https://graph.windows.net/<IdentityProviderID>/users/<UserObjectID>/getMemberObjects.
This causes the role mapping on the platform to be ineffective for the user the Assertion is applicable to.


User gets authenticated from azure but couldn't landed up with any AEM screen as saml response doesn't contain group information to redirect user to authorized page. Azure team says we need to call a REST Microsoft graph api to get group information in such case using that group.link.

We need to handle both scenarios:
1. User belongs to less than equal to 150 groups
2. User belongs to more than 150 groups

Can anyone suggest how we can achieve this? Do we need to write custom SAML authentication handler? how to call graph apis?

Quick response will be highly appreciated!!

 

Thanks in advance
Nisha

Accepted Solutions (1)

Accepted Solutions (1)

jbrar

Employee

08-06-2020

This will not work OOTB as AEM expects the "groups" attribute in the SAML response. You have 2 options for users with more than 150 groups:

 

1) Write a custom authentication handler to handle this scenario

2) Log a ticket with azure and have them increase the limit to more than 150

Answers (0)