12

Background

We're building an internal site where all users are required to be authenticated. I've configured IdentityServer to connect to the organisation's Azure AD and this is working fine. When I log in to my Sitecore Client I can choose "Login with Azure AD" and based on role mappings, I am allowed into the client.

I want our site visitors to also have to go via this login process.

What I've done so far

  • I created a blank login page on our site.
  • I checked "Require Login" under Site Grouping for our site
  • I pointed the "Login Page" under Site Grouping to my blank login page

At first I tried to follow the steps in this article, instructing me to configure a special security controller. But I misread the article, I only need to do that if I do NOT want the default behaviour of being redirected to Sitecore's login page. So the opposite of what I want.

What happens

It does not behave as intended. Or at least as I expected.

If I navigate to my site now, it redirects me to /login just fine. But then it ends up in an endless loop. I'm trying to understand why.

The URL ends up looking like this: http://sc911.sc/Demo/login?ReturnUrl=%2fDemo%2flogin%3fReturnUrl%3d%252fDemo%252flogin%253fReturnUrl%253d%25252fDemo%25252flogin%25253fReturnUrl%25253d%2525252fDemo%2525252flogin%2525253fReturnUrl%2525253d%252525252fDemo%252525252flogin%252525253fReturnUrl%252525253d%25252525252fDemo%25252525252flogin%25252525253fReturnUrl%25252525253d%2525252525252fDemo%2525252525252flogin%2525252525253fReturnUrl%2525252525253d%252525252525252fDemo%252525252525252flogin%252525252525253fReturnUrl%252525252525253d%25252525252525252fDemo%25252525252525252flogin%25252525252525253fReturnUrl%25252525252525253d%2525252525252525252fDemo%2525252525252525252flogin%2525252525252525253fReturnUrl%2525252525252525253d%252525252525252525252fDemo%252525252525252525252flogin%252525252525252525253fReturnUrl%252525252525252525253d%25252525252525252525252fDemo%25252525252525252525252flogin%25252525252525252525253fReturnUrl%25252525252525252525253d%2525252525252525252525252fDemo%2525252525252525252525252flogin%2525252525252525252525253fReturnUrl%2525252525252525252525253d%252525252525252525252525252fDemo%252525252525252525252525252flogin%252525252525252525252525253fReturnUrl%252525252525252525252525253d%25252525252525252525252525252fDemo%25252525252525252525252525252flogin%25252525252525252525252525253fReturnUrl%25252525252525252525252525253d%2525252525252525252525252525252fDemo%2525252525252525252525252525252flogin%2525252525252525252525252525253fReturnUrl%2525252525252525252525252525253d%252525252525252525252525252525252fDemo%252525252525252525252525252525252flogin%252525252525252525252525252525253fReturnUrl%252525252525252525252525252525253d%25252525252525252525252525252525252fDemo%25252525252525252525252525252525252flogin%25252525252525252525252525252525253fReturnUrl%25252525252525252525252525252525253d%2525252525252525252525252525252525252fDemo%2525252525252525252525252525252525252flogin%2525252525252525252525252525252525253fReturnUrl%2525252525252525252525252525252525253d%252525252525252525252525252525252525252fDemo%252525252525252525252525252525252525252flogin%252525252525252525252525252525252525253freturnUrl%252525252525252525252525252525252525253d%25252525252525252525252525252525252525252fDemo

At which point my Chrome gives up and throws this at me.

HTTP Error 404.15 - Not Found The request filtering module is configured to deny a request where the query string is too long.

Is there anything else I need to configure, to get this working?

Am on Sitecore 9.1.1, SXA 1.8.1

enter image description here

2
  • Are you logged into Sitecore in the same browser? We encountered similar issues if yes. Use Incognito mode to log in as visitor. Jul 24, 2019 at 19:44
  • Doesn't make sense though. I did try Icognito. However if the fact that I am logged in causes this, then it's broken. The requirement is to be Authenticated (require login).
    – Mark Cassidy
    Jul 25, 2019 at 10:40

2 Answers 2

6

So after some back and forth with Sitecore Support, this is the conclusion and the solution.

  1. The fact that SXA ends up in the endless loop has been registered as a bug. Bug reference number #349107.

  2. The solution is this

You need to add the site registration to SitecoreIdentity, making it a known entity for it to act on. We added the following configuration patch - "demo" is the name of the site we're mapping.

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/" xmlns:security="http://www.sitecore.net/xmlconfig/security/">

    <!-- In reference to Ticket #536646 on Sitecore Support Portal -->
    <sitecore role:require="Standalone or ContentDelivery or ContentManagement">
        <federatedAuthentication type="Sitecore.Owin.Authentication.Configuration.FederatedAuthenticationConfiguration, Sitecore.Owin.Authentication">
            <identityProvidersPerSites hint="list:AddIdentityProvidersPerSites">
                <mapEntry name="demo site" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication">
                    <sites hint="list">
                        <site>demo</site>
                    </sites>
                    <identityProviders hint="list:AddIdentityProvider">
                        <identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='SitecoreIdentityServer']" id="SitecoreIdentityServer" />
                    </identityProviders>
                    <externalUserBuilder type="Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, Sitecore.Owin.Authentication">
                        <IsPersistentUser>true</IsPersistentUser>
                    </externalUserBuilder>
                </mapEntry>
            </identityProvidersPerSites>
        </federatedAuthentication>
    </sitecore>
</configuration>

And then for the SXA mechanics to work, go to the site definition item (e.g. /sitecore/content/redacted/Global/Demo/Settings/Site Grouping/Demo) and find the Other Properties section. Add the following:

  • loginPage -> /identity/login/demo/SitecoreIdentityServer (demo is the name of your site)
  • requireLogin -> true

Save and publish this item (and the config) and you're good to go.

3
  • Does the requireLogin flag mean the entire site needs an authenticated user, or is it necessary to enable that even if you have only one section that requires authentication (where most is publicly accessible) Mar 4, 2020 at 1:00
  • Yea, requireLogin is site wide. You can omit it (but leave the loginPage) and then restrict anonymous access on the sections you want to put behind the login wall.
    – Mark Cassidy
    Mar 4, 2020 at 8:35
  • @MarkCassidy Do I need to add any code to the login component? I am using a custom login component. Currently nothing is happening where I am hitting /login page Sep 30, 2022 at 2:42
1

I just recently ran into this issue myself and spent hours trying to resolve it. I could hardly find any documentation related to an SXA site (i.e. a CD site) using a federate/Sitecore Identity subprovider to login. Randomly I tried removing the site groupings, and instead used a config file to setup the site:

<sitecore>
  <sites>
    <site name="mysite" loginPage="$(loginPath)mysite/SitecoreIdentityServer/mysubprovider" requireLogin="true".... />
  </sites>
  <experienceAccelerator>
    <siteResolving>
      <site name="mysite" resolve="before" />
    </siteResolving>
  </experienceAccelerator>
</sitecore>

This change seemed to actually trigger the identityProvidersPerSites entry I had in my config that matched the AzureAD examples they had commented out in the Sitecore.Owin.Authentication.IdentityServer.config. I am using PING instead of AzureAD so I had to perform some other steps as well. Since PING wasn't configured fully for me I couldn't complete the round trip back to Sitecore to make sure xConnect works, but if you maybe could loop back and comment on this answer to let me know if you get that working, it could help me too.

5
  • The solution I ended up with in many ways resemble what you outline here. I added my site to the list of sites that should be controlled by SitecoreIdentity, and defined the requireLogin and loginPage under properties under Site Grouping. Will outline the details tomorrow.
    – Mark Cassidy
    Aug 17, 2019 at 20:02
  • Hey Mark, were you able to write a small summary of how you were able to configure it in SXA? I was curious if you had to put a login page that was within the site and had anonymous access to make it work or if you made it work going directly to the Identity Provider?
    – Nate
    Aug 23, 2019 at 13:18
  • My bad, I forgot about this. Yes - will write this up in about an hour :-)
    – Mark Cassidy
    Aug 23, 2019 at 13:38
  • I've added a full write-up now.
    – Mark Cassidy
    Aug 23, 2019 at 14:38
  • Thanks for the update. Do you know the long term benefit of using the Sitecore Identity server to authenticate against a company IDP vs using the CD server itself to redirect? Having an additional server in the mix adds complexity and I am wondering if there is a benefit that you are getting from it?
    – Nate
    Aug 23, 2019 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.