Posted on 16/11/2023 10:48:45
Hi Andreas
When we get the auth token back from Azure, it contains various information in the claim - Dynamicweb uses "preferred_username" to map the user - see https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference - so the value in that field is what we try to match on the username. Username in Dynamicweb is the 'key' which is why we look at that column.
To make it look at the email field on a Dynamicweb user, we have to make a fallback in our external authentication handling that if we do not locate a user using the returned username (preferred_username field in the claims) we try to locate the user by looking at the email and use that instead. That would be a minor change from our side. Issue with this is that email is not immutable, meaning that the user can change their email address in the AD and then their login will start to fail - also 2 users in Azure could have the same email on them - i.e. info@something.com - and then when each of them login they would get the same user account in Dynamicweb. Both rare situations, but that would be the consequence.
Alternative to the above is to copy email to username field in DW - either by default or when a user starts an external login.
What are your thoughts?
