Azure AD integration & Core service

Question

I have the following setup: all CM users are Azure AD users, all CM groups have Azure as identity provider and are mapped to appropriate Azure AD groups. No users is explicitly added to CM groups. Everything works fine when using the CM.

I have following Core service script that needs to impersonates various users to perform some actions:

.....
coreServiceClient.Impersonate(userName)
...
CoreServiceClient.GetSystemWideList....
....

Unfortunately get returns 0 items.

I have added Azure AD user explicitly to the group in the CM (the same one he already has access to through Azure AD) and the script now works fine (50 items are returned and can be processed further).

It seems that when impersonating a user that has membership set through external identity provider (like Azure AD) the core service doesn't properly identify access privileges.

How can I fix this?

Answer 1

If the User you are impersonating only has implicit Group memberships (through external Group mappings), then impersonating the user by name only will indeed not work; you don’t tell the system which external groups the user is member of, after all.

If you can obtain the external Group memberships (claims) yourself, you can use the ImpersonateWithClaims method to provide all the relevant claims, so the system can do Group mapping.