AEM Azure AD SSO Integration

[prashantonkar]

We followed https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/adobeexperiencemanager-tutorial for integration Azure AD with AEM for SSO. I am facing one issue after integration. When the user logs in thru AD, the user is created in AEM. But the user is unrecognizable as the user is given a random ID. How do I get the users email/ First Name, Last Name? I need to be able to recognize this user in order to assign him to groups. When I log in thru AD and click my profile in AEM author, this is what I see. Please help.

[Raja-kp]

Hi @prashantonkar,

Please refer this article to implement the Azure AD SSO integration with AEM- https://www.albinsblog.com/2021/11/aem-website-authentication-with-azure-ad-b2c-saml.html

Regards,

Raja

[prashantonkar]

Hi @Raja-kp the link you provided is for AD-B2C. My question is on AD. There is good documentation for AD also, but facing the issue after following the steps provided by Microsoft.

[Raja-kp]

@prashantonkar Can you please share the SSO configuration.

[AndreaB69]

Hi,
I have the same issue
we were also following
https://blog.developer.adobe.com/saml-authentication-in-aem-using-microsoft-azure-active-directory-3...

I see saml claims with attributes  emailaddress, surname, givenname from azure.
tried multiple values in saml config User ID attribute 
but no luck
did you ever solve?

[prashantonkar]

I ditched this way of integration in favor of IMS. Now its working fine. 

What I tried earlier (and didn't work)?

Azure AD <> AEM

What worked ?

Azure AD <> Adobe IMS <> AEM

There is good documentation on Adobe IMS to Azure AD integration please check.

[AndreaB69]

Hi,
authentication works but I  get a random userprincipal,
I put details here

https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/aem-6-5-sp13-saml-with-azu...

[prashantonkar]

Yes, I faced the same issue too. I couldn't resolve hence went with IMS integration which solved the issue.

[AndreaB69]

Hi,
just to update for other poor souls reading this
we solved with
Synchronized attributes

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress=profile/email
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname=profile/givenName
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname=profile/familyName