Access Management account error

Question

While we are doing some validations in CMS after enabling Access Management, Today we got below error for one of the user while trying to Save component. We will be going live Tomorrow, can you please help, For other users we have not seen this error.

    Account '[email protected]' is impersonated by name. This may be an Access Management account and group mappings will not be taken into account. Avoid impersonating such accounts by name. Stack Trace:    at Tridion.ContentManager.Security.AuthorizationManager.LoadAccessToken(String userName, String impersonationUserName)
   at Tridion.ContentManager.Session..ctor(String userName, String impersonationUserName)
   at Tridion.ContentManager.CoreService.CoreServiceBase.Impersonate(String userName)
   at SyncInvokeImpersonate(Object , Object[] , Object[] )
   at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)
   at Tridion.ContentManager.CoreService.CoreServiceInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)
   at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc)
   at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)
   at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage11(MessageRpc& rpc)
   at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)
   at System.ServiceModel.Dispatcher.ChannelHandler.DispatchAndReleasePump(RequestContext request, Boolean cleanThread, OperationContext currentOperationContext)
   at System.ServiceModel.Dispatcher.ChannelHandler.HandleRequest(RequestContext request, OperationContext currentOperationContext)
   at System.ServiceModel.Dispatcher.ChannelHandler.AsyncMessagePump(IAsyncResult result)
   at System.ServiceModel.Dispatcher.ChannelHandler.OnAsyncReceiveComplete(IAsyncResult result)
   at System.Runtime.Fx.AsyncThunk.UnhandledExceptionFrame(IAsyncResult result)
   at System.Runtime.AsyncResult.Complete(Boolean completedSynchronously)
   at System.ServiceModel.Channels.TransportDuplexSessionChannel.TryReceiveAsyncResult.OnReceive(IAsyncResult result)
   at System.Runtime.Fx.AsyncThunk.UnhandledExceptionFrame(IAsyncResult result)
   at System.Runtime.AsyncResult.Complete(Boolean completedSynchronously)
   at System.ServiceModel.Channels.SynchronizedMessageSource.ReceiveAsyncResult.OnReceiveComplete(Object state)
   at System.ServiceModel.Channels.SessionConnectionReader.OnAsyncReadComplete(Object state)
   at System.Runtime.Fx.AsyncThunk.UnhandledExceptionFrame(IAsyncResult result)
   at System.Net.LazyAsyncResult.Complete(IntPtr userToken)
   at System.Net.LazyAsyncResult.ProtectedInvokeCallback(Object result, IntPtr userToken)
   at System.Net.Security.NegotiateStream.ProcessFrameBody(Int32 readBytes, Byte[] buffer, Int32 offset, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.NegotiateStream.ReadCallback(AsyncProtocolRequest asyncRequest)
   at System.Net.AsyncProtocolRequest.CompleteRequest(Int32 result)
   at System.Net.FixedSizeReader.CheckCompletionBeforeNextRead(Int32 bytes)
   at System.Net.FixedSizeReader.ReadCallback(IAsyncResult transportResult)
   at System.Runtime.AsyncResult.Complete(Boolean completedSynchronously)
   at System.ServiceModel.Channels.ConnectionStream.IOAsyncResult.OnAsyncIOComplete(Object state)
   at System.Net.Sockets.SocketAsyncEventArgs.OnCompleted(SocketAsyncEventArgs e)
   at System.Net.Sockets.SocketAsyncEventArgs.FinishOperationSuccess(SocketError socketError, Int32 bytesTransferred, SocketFlags flags)
   at System.Net.Sockets.SocketAsyncEventArgs.CompletionPortCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* nativeOverlapped)
   at System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* pOVERLAP)

Answer 1

The warning message is quite explicit, isn't it? :-)

Account '[email protected]' is impersonated by name. This may be an Access Management account and group mappings will not be taken into account. Avoid impersonating such accounts by name.

In general, if a user authenticates through Access Management, additional user claims are provided to CM. At least, user Roles as specified in Access Management and possibly also forwarded claims from the IDP. These additional claims can/will be used in CM to determine CM Group Memberships. For example, if a user is assigned the CM Administrator Role in Access Management, the user will implicitly become a member of the CM System Administrators Group (through a predefined Group Mapping on the role claim provided by Access Management).

However, if you create your own CM Session (in TOM.NET or Core Service WCF) and impersonate using an API which only specifies user name, these additional claims are not provided to CM. As a result, the CM Group Mappings are not applied. This, in turn, can result in the impersonated user having fewer Privileges/Rights/Permissions that what the user has when signing in through Access Management.

The mentioned warning occurs if such impersonation API is being used (the Stack Trace reveals it's the Core Service Impersonate method) and the impersonated user is neither a Windows nor LDAP user. The warning message explains what the consequences are.

Unfortunately, the Stack Trace is "server-side", so you don't see the context of the Core Service client which called this method; you will have to figure this out yourself.

So, in general, use of impersonation APIs which only take a user name should be avoided if the impersonated user can be an Access Management user (or a user for the earlier SAML 2.0 integration, for that matter). The Core Service also provides an ImpersonateWithClaims method, which does allow you to pass additional claims.

If the Core Service client is in a Web Application which supports Access Management authentication (for now, that means in the CME Web App), the additional claims can be obtained using .NET's ClaimsPrincipal. For example: HttpContext.Current.User as ClaimsPrincipal