How to map Liferay site roles with Azure AD

Issue

• How to map Liferay site roles to Azure AD roles when configuring SAML?
• For example, if there is a role called Content Author under site roles, how to configure this role in Azure AD?

Environment

• Liferay DXP [all versions]

Resolution

1. As per the compatibility matrix, Liferay DXP Self hosted Integrated Technologies Compatibility Matrix, Microsoft Azure is not supported as an Identity Provider (IdP), therefore, the support provided with this current integration is limited.
2. The supported IdPs are ADFS, Liferay DXP, Liferay Portal EE, Okta, OpenAM 13+, PingFederate, Shibboleth, and Siteminder.
3. However, direct role mapping between Liferay site roles and Azure AD roles is not supported when using SAML.
4. Users can achieve similar functionality by mapping Azure AD groups to Liferay user groups and then assigning these groups to site roles.

Additional Information

• See Creating and Managing User Groups in Liferay for details on managing user groups within Liferay.
• See Create a group with members and view all groups and members for creating groups in Azure AD.
• Refer to How to Manage Groups in Microsoft Azure AD for information on managing groups in Azure AD.
• Check Importing User Groups’ Memberships from an External IdP through SAML for more detailed instructions on importing user group memberships via SAML.