use external application to get Identity Server token / cookie

Question

Does anyone have experience connecting to Identity Server in 9.1 to get an authentication token / cookie of sorts?

I'm trying to do this in PowerShell.

In Commerce 9.x, you could connect directly to IdentityServer's /connect/token endpoint to obtain a token that you could then use to send requests to the engine.

In XP 9.1, I'm trying to make calls to various /sitecore pages using PowerShell to help "warm-up" the instance. In the past I was shown how to access /sitecore/login in order to populate a $session object. What does that look like now with IdentityServer?

Answer 1

With some serious Googling, and with the help of the Community and this gist I was able to successfully get a token from Sitecore 9.1's Identity Server.

First, you need to add a new Client to the Sitecore.IdentityServer.Host.xml file (\Config\production\Sitecore.IdentityServer.Host.xml).

I dug up more details on the PasswordClient and created my own version by copying PasswordClient as a template and called it PostmanClient giving it a client id of "postman-api".

 <Clients>
    <DefaultClient>
      <AllowedCorsOrigins>
        <AllowedCorsOriginsGroup1>https://habitathome.dev.local|https://habitathomebasic.dev.local</AllowedCorsOriginsGroup1>
      </AllowedCorsOrigins>
    </DefaultClient>
    <PasswordClient>
      <ClientSecrets>
        <ClientSecret1>ClientSecret</ClientSecret1>
      </ClientSecrets>
    </PasswordClient>
    <PostmanClient>
      <ClientId>postman-api</ClientId>
      <ClientName>postman-api</ClientName>
      <AccessTokenType>0</AccessTokenType>
      <AllowOfflineAccess>true</AllowOfflineAccess>
      <AlwaysIncludeUserClaimsInIdToken>false</AlwaysIncludeUserClaimsInIdToken>
      <AccessTokenLifetimeInSeconds>3600</AccessTokenLifetimeInSeconds>
      <IdentityTokenLifetimeInSeconds>3600</IdentityTokenLifetimeInSeconds>
      <AllowAccessTokensViaBrowser>true</AllowAccessTokensViaBrowser>
      <RequireConsent>false</RequireConsent>
      <RequireClientSecret>true</RequireClientSecret>
      <AllowedGrantTypes>
        <AllowedGrantType1>password</AllowedGrantType1>
      </AllowedGrantTypes>
      <AllowedCorsOrigins>
      </AllowedCorsOrigins>
      <AllowedScopes>
        <AllowedScope1>openid</AllowedScope1>
        <AllowedScope2>sitecore.profile</AllowedScope2>
        <AllowedScope3>sitecore.profile.api</AllowedScope3>
      </AllowedScopes>
      <ClientSecrets>
        <ClientSecret1>ClientSecret</ClientSecret1>
      </ClientSecrets>
      <UpdateAccessTokenClaimsOnRefresh>true</UpdateAccessTokenClaimsOnRefresh>
    </PostmanClient>
  </Clients>

Once that was done (and I restarted identity server) I was able to use the gist sample and provide values relevant to my newly added client:

$identityserverUrl = "https://<url-to-your-identityserver>"
$tokenendpointurl = $identityserverUrl + "/connect/token"
$granttype = "password" # client_credentials / password 
$client_id = "postman-api"
$client_secret = "ClientSecret"
$username = "sitecore\admin"
$password = "superStrongPassword"
$scope = "openid"

We are then left with an access_token which can be used to connect to Sitecore.

Answer 2

But what i have trying since 10 days is to have the client_credentials based configuration set up, It says invalid client id, Is it only here we have to configure or i am missing some thing. \Config\production\Sitecore.IdentityServer.Host.xml