Sam7

provider "azurerm" {
  features {}
}

terraform {
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "3.19.0"
    }

Sam7

private static void AddGroups(BackOfficeIdentityUser autoLinkUser, IEnumerable<string> groupsToAdd, Dictionary<string, Claim> adGroupNames)
{
    // add new groups
    foreach (var adGroup in groupsToAdd.Where(s => !string.IsNullOrWhiteSpace(s)))
    {
        var userService = UmbracoContext.Current.Application.Services.UserService;
        var userGroup = userService.GetUserGroupByAlias(adGroup);
        if (userGroup == null)
        {
            // Create new Group without permissions. They have to be 

Sam7

private static void RemoveGroups(BackOfficeIdentityUser autoLinkUser, IReadOnlyUserGroup[] groupsToRemove)
{
    // remove old groups
    // for some reason it only works if we adjust the groups first and then the roles.
    // only works when both are changed and only in that order :S
    var groups = autoLinkUser.Groups.ToList();
    foreach (var adGroup in groupsToRemove) groups.RemoveAll(x => x.Alias.Equals(adGroup.Alias));
    autoLinkUser.Groups = groups.ToArray();

    // the same for roles

Sam7

private const string ClaimsTypeRole = "http://schemas.xmlsoap.org/claims/Group";

// Only take AD groups into consideration that have start with this prefix.
private const string ActiveDirectoryRolePrefix = "SG-STA-Umbraco";

// Append this prefix to the group alias in order not to get confused with manually created groups
private const string GroupAliasPrefix = "AD";

// Append this prefix to the group label / name in order not to get confused with manually created groups
private const string GroupLabelPrefix = "AD Group: ";

Sam7

private static void OnAutoLinking(BackOfficeIdentityUser autoLinkUser, ExternalLoginInfo loginInfo)
{
    OnExternalLogin(autoLinkUser, loginInfo);
}

Sam7

private static void ConfigureBackOfficeAdfsAuthentication(
    IAppBuilder app,
    string caption = "AD FS",
    string style = "btn-microsoft",
    string icon = "fa-windows")
{
    // Load configuration from web.config
    var adfsMetadataEndpoint = ConfigurationManager.AppSettings["AdfsMetadataEndpoint"];
    var adfsRelyingParty = ConfigurationManager.AppSettings["AdfsRelyingParty"];
    var adfsFederationServerIdentifier = ConfigurationManager.AppSettings["AdfsFederationServerIdentifier"];

Sam7

public override void Configuration(IAppBuilder app)
{
    //Configure the Identity user manager for use with Umbraco Back office

    // *** EXPERT: There are several overloads of this method that allow you to specify a custom UserStore or even a custom UserManager!            
    app.ConfigureUserManagerForUmbracoBackOffice(
        ApplicationContext.Current,
        //The Umbraco membership provider needs to be specified in order to maintain backwards compatibility with the 
        // user password formats. The membership provider is not used for authentication, if you require custom logic
        // to validate the username/password against an external data source you can create create a custom UserManager

Sam7

<appSettings>
    <!--...-->
    <add key=”owin:appStartup” value=”UmbracoCustomOwinStartup” />
    <add key=”AdfsMetadataEndpoint” value=”https://sts.yourdomain.tld/federationmetadata/2007-06/federationmetadata.xml" />
    <add key=”AdfsRelyingParty” value=”https://localhost:44344/" />
    <add key=”AdfsFederationServerIdentifier” value=”https://sts.yourdomain.tld/adfs/services/trust" />
<appSettings />

Sam7

using Microsoft.Owin;
using Owin;
using Umbraco.Core;
using Umbraco.Core.Security;
using Umbraco.Web.Security.Identity;
using Umbraco.Web;
using Web;
using System.Configuration;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.WsFederation;

Sam7

public void Configuration(IAppBuilder app)
{
    //Configure the Identity user manager for use with Umbraco Back office

    // *** EXPERT: There are several overloads of this method that allow you to specify a custom UserStore or even a custom UserManager!            
    app.ConfigureUserManagerForUmbracoBackOffice(
        ApplicationContext.Current,
        //The Umbraco membership provider needs to be specified in order to maintain backwards compatibility with the 
        // user password formats. The membership provider is not used for authentication, if you require custom logic
        // to validate the username/password against an external data source you can create create a custom UserManager