Authorization issue between Horizon and Content Management

Question

I'm trying to setup Horizon 10.0.1 with Sitecore 10.0.1 on Azure with custom domain (no Content Hub). I followed all the steps from the Azure PaaS Installation guide.

I use the following host names:

test-id.MYHOSTNAME.eu
test-cm.MYHOSTNAME.eu
test-horizon.MYHOSTNAME.eu

I have valid certificate for *.MYHOSTNAME.eu.

In Sitecore Identity in Config/production/Sitecore.IdentityServer.AuthoringHost.xml file I have

<HorizonHttpsCorsOrigin>https://test-horizon.MYHOSTNAME.eu</HorizonHttpsCorsOrigin>

On CM in /App_Config/Modules/Horizon/Sitecore.Horizon.Integration.config I have:

<setting name="Horizon.ClientHost" value="https://test-horizon.MYHOSTNAME.eu" />

and I have

<setting name="Sitecore.Services.SecurityPolicy" value="Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy, Sitecore.Services.Infrastructure" patch:source="Sitecore.Horizon.Integration.SSC.config"/>

In horizon in /sitecore/Sitecore.Horizon.Authoring.Plugin/Config/Host.xml I have:

<Settings>
<FederatedUI>
    <HostBaseUrl>https://test-horizon.MYHOSTNAME.eu</HostBaseUrl>
</FederatedUI>
<ApiGateway>
    <SitecoreHost>https://test-cm.MYHOSTNAME.eu</SitecoreHost>
    <InternalSitecoreHost></InternalSitecoreHost>
</ApiGateway>
</Settings>

In horizon in /sitecore/Sitecore.Horizon.Authoring.Plugin/Config/OpenIdConnect.xml:

<Settings>
  <Sitecore>
    <Authentication>
      <OpenIdConnectOptions>
        <RequireHttpsMetadata>false</RequireHttpsMetadata>
        <ClientId>Sitecore</ClientId>
        <Authority>https://test-identity.MYHOSTNAME.eu/</Authority>
        <LockTimeoutSeconds>300</LockTimeoutSeconds>
        <ClientSecret></ClientSecret>
      </OpenIdConnectOptions>
      <BearerAuthenticationOptions>
        <Authority>https://test-identity.MYHOSTNAME.eu/</Authority>
      </BearerAuthenticationOptions>
    </Authentication>
  </Sitecore>
</Settings>

in /sitecore/Sitecore.Horizon.ContentHub.Dam.Plugin/Config/Plugin.xml:

<Settings>
  <ContentHubDam>
    <PlatformUrl>https://test-cm.MYHOSTNAME.eu</PlatformUrl>
  </ContentHubDam>
</Settings>

in /sitecore/Sitecore.Zenith/Config/Sitecore.Zenith.Proxy.xml:

<Settings>
  <Proxy>
    <DataServiceEndpoint>https://test-cm.MYHOSTNAME.eu</DataServiceEndpoint>
  </Proxy>
  <Security>
    <EnableAuthorization>true</EnableAuthorization>
  </Security>
</Settings>

When I open horizon url I'm redirected to identity server. I login as Admin, and I'm redirected back to horizon url /composer/pages/editor but the screen keeps refreshing and there is an error saying

The page did not load properly. Try refreshing the page. If the error reoccurs, contact your system administrator.

With developer tools I can see that there is a call to https://test-horizon.MYHOSTNAME.eu/horizon/api and the response is

{
    "data": {
        "configuration": {
            "primaryPlatformUrl": "https://test-cm.MYHOSTNAME.eu",
            "additionalPlatformUrls": [],
            "hostVerificationToken": "",
            "contentRootItemId": "00000000-0000-0000-0000-000000000000",
            "__typename": "Configuration"
        }
    },
    "errors": [{
        "message": "{\"Message\":\"Authorization has been denied for this request.\"}",
        "extensions": {
            "code": "NOT_AUTHORIZED"
        }
    }]
}

In Application Insights I can see entries from CM server saying for all /sitecore/api/ssc/horizon/* request returning 401 response, e.g. /sitecore/api/ssc/horizon/configuration/?sc_horizon=api or /sitecore/api/ssc/horizon/sites/-/getsites?sc_horizon=api&IncludeSystemSites=False

But when I open it via url directly in the browser https://test-cm.MYHOSTNAME.eu/sitecore/api/ssc/horizon/sites/-/getsites?sc_horizon=api&IncludeSystemSites=False I can see valid json response.

It looks like identity server configuration is ok cause it allows to login from Horizon. And it looks like horizon config is ok as well - it sends requests to CM and CM receives them. But for some reason CM returns 401 for requests sent from Horizon.

I saw the other question related to Horizon reloading all the time ( SItecore 9.3 - Horizon - Page keeps on reloading issue ) but I do have Sitecore Identity Server enabled, so it's not the reason of my issues.

Any idea if I missed something?

---

EDIT

I found an exception in AI coming from CM server:

Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationMiddleware - Authentication failed   

Exception: Microsoft.IdentityModel.Tokens.SecurityTokenInvalidAudienceException
Message: IDX10214: Audience validation failed. Audiences: '[PII is hidden]'. Did not match: validationParameters.ValidAudience: '[PII is hidden]' or validationParameters.ValidAudiences: '[PII is hidden]'.
Source: Microsoft.IdentityModel.Tokens
   at Microsoft.IdentityModel.Tokens.Validators.ValidateAudience(IEnumerable`1 audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) in C:\agent2\_work\56\s\src\Microsoft.IdentityModel.Tokens\Validators.cs:line 108
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateTokenPayload(JwtSecurityToken jwtToken, TokenValidationParameters validationParameters) in C:\agent2\_work\56\s\src\System.IdentityModel.Tokens.Jwt\JwtSecurityTokenHandler.cs:line 737
   at Microsoft.Owin.Security.Jwt.JwtFormat.Unprotect(String protectedText)
   at Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationHandler.d__3.MoveNext()

I'm not sure if that's relevant. Adding here just in case.

Answer 1

In my case endless redirects were caused by 'Remove trailing slash' URL Rewrite rule on CM. Added condition to ignore requests from Horizon:

<add input="{REQUEST_URI}" pattern=".*(api/ssc/horizon).*" negate="true" />

So that the entire rule looks like the following in my 10.1.1 setup:

<rule name="Remove trailing slash" stopProcessing="true">
  <match url="(.*)/$" />
    <conditions>
      <add input="{REQUEST_URI}" pattern=".*(api/ma).*" negate="true" />
      <add input="{REQUEST_URI}" pattern=".*(api/ssc/horizon).*" negate="true" />
      <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
      <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
  </conditions>
  <action type="Redirect" redirectType="Permanent" url="{R:1}" />
</rule>

Answer 2

As you mentioned in your post, you have the correct host names of CM, Identity server, and horizon site in all the configuration files you specified. The error is while loading [horizonsite]/composer/pages/, the site tries to do Owin authentication to the Identity server but it fails and retries again and again. This causes to reload the horizon editor repeatedly.

This can be fixed by updating the correct hostname(if incorrect) of your identity site in the following configuration [CM]\App_Config\Sitecore\Owin.Authentication.IdentityServer\Sitecore.Owin.Authentication.IdentityServer.config