Sitecore 9.3
I have Okta federated auth working great on the public site. But I am trying to get the sitecore editors to log in, I can never get access for their users. Does Sitecore require a separate url for CM and delivery for federated login? It works fine with Identity Server, but I am trying to get away from IS.
And I am never able to get Okta to show up in the login screen
After I log in, I am an admin and in an editor role, but I get access denied to the content editor (/sitecore). If I go to /sitecore/admin I get a looping login.
Here is the config
<?xml version="1.0" encoding="utf-8"?>
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/">
<sitecore>
<settings>
<setting name="Foundation.Identity.Okta.ClientId" value="XXXXXXX"/>
<setting name="Foundation.Identity.Okta.ClientSecret" value="XXXXXX"/>
<setting name="Foundation.Identity.Okta.Authority" value="https://Client.okta.com"/>
<setting name="Foundation.Identity.Okta.OAuthTokenEndpoint" value="/oauth2/v1/token"/>
<setting name="Foundation.Identity.Okta.OAuthUserInfoEndpoint" value="/oauth2/v1/userinfo/" />
<setting name="Foundation.Identity.Okta.OAuthRedirectUri" value="XXXXXXXX"/>
<setting name="Foundation.Identity.Okta.ApiKey" value="#{mysite.OktaProvider.ApiKey}" />
<setting name="Foundation.Identity.Okta.LoadBalanceDNS" value="XXXXXXXX"/>
<setting name="Foundation.Identity.Okta.AccessDeniedUri" value="/Access-Denied"/>
</settings>
<pipelines>
<owin.identityProviders>
<processor type="Sitecore.Foundation.Okta.OktaIdentityProvider, Sitecore.Foundation.Okta" resolve="true" />
</owin.identityProviders>
<!--
Pipeline to handle OpenIdConnectAuthenticationNotification AuthorizationCodeReceived event / callback.
-->
<Okta.AuthorizationCodeReceived>
<processor type="Sitecore.Foundation.Okta.Pipelines.Okta.AuthorizationCodeReceived.MapClaims, Sitecore.Foundation.Okta" resolve="true" />
</Okta.AuthorizationCodeReceived>
<!--<owin.cookieAuthentication.signedIn>
<processor type="Sitecore.Foundation.Okta.Pipelines.owin.cookieAuthentication.signedIn.FillUserProfileFacet, Sitecore.Foundation.Okta"
patch:before="processor[@type='Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.CleanupUserProfile, Sitecore.Owin.Authentication']"
resolve="true" />
</owin.cookieAuthentication.signedIn>-->
<startTracking>
<processor type="Sitecore.Foundation.Okta.Pipelines.startTracking.FillUserProfileFacetTracker, Sitecore.Foundation.Okta"
patch:after="processor[@type='Sitecore.ExperienceExplorer.Analytics.Pipelines.StartTracking.ApplyExplorerModel, Sitecore.ExperienceExplorer.Analytics']"
resolve="true" />
</startTracking>
</pipelines>
<federatedAuthentication type="Sitecore.Owin.Authentication.Configuration.FederatedAuthenticationConfiguration, Sitecore.Owin.Authentication">
<identityProvidersPerSites hint="list:AddIdentityProvidersPerSites">
<mapEntry name="Client" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true">
<sites hint="list">
<site>Client</site>
</sites>
<identityProviders hint="list:AddIdentityProvider">
<identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='Okta']" />
</identityProviders>
<externalUserBuilder patch:instead="*[@type='Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, Sitecore.Owin.Authentication']" type="Sitecore.Foundation.Okta.Providers.UserBuilder, Sitecore.Foundation.Okta" resolve="true">
<param desc="isPersistentUser">true</param>
</externalUserBuilder>
</mapEntry>
</identityProvidersPerSites>
<identityProviders hint="list:AddIdentityProvider">
<identityProvider id="Okta" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication" >
<param desc="name">$(id)</param>
<param desc="domainManager" type="Sitecore.Abstractions.BaseDomainManager" resolve="true" />
<caption>Log in with Okta</caption>
<icon>/assets/okta.png</icon>
<domain>Clienttech</domain>
<transformations hint="list:AddTransformation">
<transformation name="everyone access" type="Sitecore.Owin.Authentication.Services.DefaultTransformation,Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="groups" value="SG-ClientCentralSitecoreAdmins" />
</sources>
<targets hint="raw:AddTarget">
<claim name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" value="Clienttech\editor" />
</targets>
<keepSource>true</keepSource>
</transformation>
<transformation name="admin access" type="Sitecore.Owin.Authentication.Services.DefaultTransformation,Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="groups" value="SG-ClientCentralSitecoreAdmins" />
</sources>
<targets hint="raw:AddTarget">
<claim name="http://www.sitecore.net/identity/claims/isAdmin" value="true" />
</targets>
<keepSource>true</keepSource>
</transformation>
<transformation name="map contributor role" type="Sitecore.Owin.Authentication.Services.DefaultTransformation,Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="iss" value="https://Client.okta.com" />
</sources>
<targets hint="raw:AddTarget">
<claim name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" value="Clienttech\webuser" />
</targets>
<keepSource>true</keepSource>
</transformation>
<transformation name="fullname" type="Sitecore.Owin.Authentication.Services.DefaultTransformation,Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="name" />
</sources>
<targets hint="raw:AddTarget">
<claim name="FullName" />
</targets>
</transformation>
</transformations>
</identityProvider>
</identityProviders>
</federatedAuthentication>
<oktaSettings>
<oktaFieldMappings type="Sitecore.Foundation.Okta.Models.OktaFieldMapping, Sitecore.Foundation.Okta">
<fieldMappings hint="raw:AddItem">
<field name="UserCode" OktaFieldName="oktaCode" />
</fieldMappings>
</oktaFieldMappings>
</oktaSettings>
</sitecore>
</configuration>