Sitecore redirecting to federated authentication provider on unauthorized

Question

I have a Sitecore 9 site configured to use an OWIN provider as described in this article. The site also allows users to authenticate via forms authentication. The two authentication methods are working at this point.

Here's the issue: Whenever a user hits a page that they are unauthorized to view, Sitecore immediately redirects them to the OWIN providers's login page. What we need instead is for Sitecore to display a custom 403 Unauthorized page with relevant information. We have installed the plugin "Sitecore Error Manager", so we already have the ability to display a 403 page.

How do we change this behavior and tell Sitecore to redirect to our 403 page instead of the federated auth login page?

Answer 1

You can set the NoAccessUrl setting or the loginPage attribute on the sitedefinition to point to your custom page. This article has an example of using the NoAccessUrl to point to a custom page.

Answer 2

This wasn't a Sitecore issue - it was an MVC issue. The redirects to the login page were occuring when we hit a controller decorated with [Authorize] that we weren't authorized for.

To change this behavior, we extended the Authorize attribute and set a custom redirect URL like this: https://forums.asp.net/t/2039316.aspx?Change+redirect+page+when+user+is+unauthorized