1

Sitecore 9.3

I have Okta federated auth working great on the public site. But I am trying to get the sitecore editors to log in, I can never get access for their users. Does Sitecore require a separate url for CM and delivery for federated login? It works fine with Identity Server, but I am trying to get away from IS.

And I am never able to get Okta to show up in the login screen

enter image description here

After I log in, I am an admin and in an editor role, but I get access denied to the content editor (/sitecore). If I go to /sitecore/admin I get a looping login.

enter image description here

Here is the config

  <?xml version="1.0" encoding="utf-8"?>
  <configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/">
    <sitecore>
      <settings>
        <setting name="Foundation.Identity.Okta.ClientId" value="XXXXXXX"/>
        <setting name="Foundation.Identity.Okta.ClientSecret" value="XXXXXX"/>
        <setting name="Foundation.Identity.Okta.Authority" value="https://Client.okta.com"/>
        <setting name="Foundation.Identity.Okta.OAuthTokenEndpoint" value="/oauth2/v1/token"/>
        <setting name="Foundation.Identity.Okta.OAuthUserInfoEndpoint" value="/oauth2/v1/userinfo/" />
        <setting name="Foundation.Identity.Okta.OAuthRedirectUri" value="XXXXXXXX"/> 
        <setting name="Foundation.Identity.Okta.ApiKey" value="#{mysite.OktaProvider.ApiKey}" />
        <setting name="Foundation.Identity.Okta.LoadBalanceDNS" value="XXXXXXXX"/>
        <setting name="Foundation.Identity.Okta.AccessDeniedUri" value="/Access-Denied"/>

      </settings>
      
      <pipelines>      
        <owin.identityProviders>
          <processor type="Sitecore.Foundation.Okta.OktaIdentityProvider, Sitecore.Foundation.Okta" resolve="true" />
        </owin.identityProviders>
        <!-- 
          Pipeline to handle OpenIdConnectAuthenticationNotification AuthorizationCodeReceived event / callback. 
        -->
        <Okta.AuthorizationCodeReceived>
          <processor type="Sitecore.Foundation.Okta.Pipelines.Okta.AuthorizationCodeReceived.MapClaims, Sitecore.Foundation.Okta" resolve="true" />
        </Okta.AuthorizationCodeReceived>

        <!--<owin.cookieAuthentication.signedIn>
          <processor type="Sitecore.Foundation.Okta.Pipelines.owin.cookieAuthentication.signedIn.FillUserProfileFacet, Sitecore.Foundation.Okta"
                     patch:before="processor[@type='Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.CleanupUserProfile, Sitecore.Owin.Authentication']"
                     resolve="true" />
        </owin.cookieAuthentication.signedIn>-->

        <startTracking>
          <processor type="Sitecore.Foundation.Okta.Pipelines.startTracking.FillUserProfileFacetTracker, Sitecore.Foundation.Okta" 
                     patch:after="processor[@type='Sitecore.ExperienceExplorer.Analytics.Pipelines.StartTracking.ApplyExplorerModel, Sitecore.ExperienceExplorer.Analytics']"
                     resolve="true" />
        </startTracking>
      </pipelines>

      <federatedAuthentication type="Sitecore.Owin.Authentication.Configuration.FederatedAuthenticationConfiguration, Sitecore.Owin.Authentication">
        <identityProvidersPerSites hint="list:AddIdentityProvidersPerSites">
          <mapEntry name="Client" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true">
            <sites hint="list">
              <site>Client</site>
            </sites>

            <identityProviders hint="list:AddIdentityProvider">
              <identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='Okta']" />
            </identityProviders>

            <externalUserBuilder patch:instead="*[@type='Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, Sitecore.Owin.Authentication']" type="Sitecore.Foundation.Okta.Providers.UserBuilder, Sitecore.Foundation.Okta" resolve="true">
              <param desc="isPersistentUser">true</param>
            </externalUserBuilder>
          </mapEntry>
        </identityProvidersPerSites>

        <identityProviders hint="list:AddIdentityProvider">
          <identityProvider id="Okta" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication" >
            <param desc="name">$(id)</param>
            <param desc="domainManager" type="Sitecore.Abstractions.BaseDomainManager" resolve="true" />
            <caption>Log in with Okta</caption>
            <icon>/assets/okta.png</icon>
            <domain>Clienttech</domain>
            <transformations hint="list:AddTransformation">
              
              <transformation name="everyone access" type="Sitecore.Owin.Authentication.Services.DefaultTransformation,Sitecore.Owin.Authentication">
                <sources hint="raw:AddSource">
                  <claim name="groups" value="SG-ClientCentralSitecoreAdmins" />
                </sources>
                <targets hint="raw:AddTarget">
                  <claim name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" value="Clienttech\editor" />
                </targets>
                
                <keepSource>true</keepSource> 
              </transformation>

              <transformation name="admin access" type="Sitecore.Owin.Authentication.Services.DefaultTransformation,Sitecore.Owin.Authentication">
                <sources hint="raw:AddSource">
                  <claim name="groups" value="SG-ClientCentralSitecoreAdmins" />
                </sources>
                <targets hint="raw:AddTarget">
                  <claim name="http://www.sitecore.net/identity/claims/isAdmin" value="true" />
                </targets>
                
                <keepSource>true</keepSource> 
              </transformation>

              <transformation name="map contributor role" type="Sitecore.Owin.Authentication.Services.DefaultTransformation,Sitecore.Owin.Authentication">
                <sources hint="raw:AddSource">
                  <claim name="iss" value="https://Client.okta.com" />
                </sources>
                <targets hint="raw:AddTarget">
                  <claim name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" value="Clienttech\webuser" />
                </targets>
                
                <keepSource>true</keepSource>
              </transformation>

              <transformation name="fullname" type="Sitecore.Owin.Authentication.Services.DefaultTransformation,Sitecore.Owin.Authentication">
                <sources hint="raw:AddSource">
                  <claim name="name" />
                </sources>
                <targets hint="raw:AddTarget">
                  <claim name="FullName" />
                </targets>
              </transformation>
              
            </transformations>
          </identityProvider>
        </identityProviders>

      </federatedAuthentication>
      <oktaSettings>
        <oktaFieldMappings type="Sitecore.Foundation.Okta.Models.OktaFieldMapping, Sitecore.Foundation.Okta">
          <fieldMappings hint="raw:AddItem">
            <field name="UserCode" OktaFieldName="oktaCode" />
          </fieldMappings>
        </oktaFieldMappings>
      </oktaSettings>

    </sitecore>
  </configuration>
2
  • Can you add to your question setup of Login/Logout redirect URIs and Initiate login URI from Okta? Apr 9, 2021 at 22:19
  • 1
    Thanks @PeterProcházka I finally got it working late last night. See my answer below.
    – Chris Auer
    Apr 10, 2021 at 13:25

1 Answer 1

1

I had the identity server disabled by breaking the url to the identity server in the config file Sitecore.Owin.Authentication.IdentityServer.config. My fix was to enable to config file Sitecore.Owin.Authentication.IdentityServer.Disabler.config.example (just remove the example). This completely disables the identity server and allow federated auth load right. I dont see any examples of anyone else doing that, but it worked.

That file contains:

<?xml version="1.0" encoding="utf-8"?>

<!--

Purpose: This include file disables Sitecore Identity authentication.

-->
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/" xmlns:set="http://www.sitecore.net/xmlconfig/set/" >
    <sitecore>
        <federatedAuthentication>
            <identityProviders>
                <identityProvider id="SitecoreIdentityServer">
                    <enabled>false</enabled>
                </identityProvider>
            </identityProviders>
        </federatedAuthentication>
        
        <sites>
            <site name="shell" set:loginPage="/sitecore/login"/>
            <site name="admin" set:loginPage="/sitecore/admin/login.aspx"/>
        </sites>
    </sitecore>
</configuration>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.