Sitecore CM login is not working on Gateway url

Question

I have requirement of exposing Sitecore CMS site through gateway url. Gateway is setup properly and gateway url has been updated in TargetHostName and identityServerAuthority in sitecore config.

But when we try to login with Gateway CM url, after user login, page getting redirect back to login page of internal cm url.

Error stack on log:

10620 02:32:37 ERROR Application error.
Exception: System.Web.HttpUnhandledException
Message: Exception of type 'System.Web.HttpUnhandledException' was thrown.
Source: System.Web
   at System.Web.UI.Page.HandleError(Exception e)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest()
   at System.Web.UI.Page.ProcessRequest(HttpContext context)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Nested Exception

Exception: System.Reflection.TargetInvocationException
Message: Exception has been thrown by the target of an invocation.
Source: mscorlib
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at Sitecore.Reflection.ReflectionUtil.InvokeMethod(MethodInfo method, Object[] parameters, Object obj)
   at Sitecore.Nexus.Pipelines.NexusPipelineApi.Resume(PipelineArgs args, Pipeline pipeline)
   at Sitecore.Pipelines.Pipeline.Start(PipelineArgs args, Boolean atomic)
   at Sitecore.sitecore.login.Default.LoggedIn()
   at Sitecore.sitecore.login.Default.LoginClicked(Object sender, EventArgs e)
   at System.Web.UI.WebControls.Button.OnClick(EventArgs e)
   at System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Nested Exception

Exception: Sitecore.Exceptions.SecurityException
Message: Only local URLs are allowed.
Source: Sitecore.Kernel
   at Sitecore.Web.Authentication.DefaultTicketManager.CheckOnExternalUrl(String startUrl)
   at Sitecore.Web.Authentication.DefaultTicketManager.CreateTicket(String userName, String startUrl, Boolean persist)
   at Sitecore.Pipelines.LoggedIn.Ticket.Process(LoggedInArgs args)



9224 02:32:38 WARN  Request is redirected to login page. Requested url: /sitecore/client/Applications/Launchpad?sc_lang=en, User: sitecore\Anonymous, Website: shell
14196 02:32:39 INFO  HttpModule is being initialized 

Any suggestion would be appreciated to fix this issue.

NOTE: We are disabled the IS, we are not using it. Sitecore version: 10.2

Answer 1

Sitecore has a ApplyRedirect pipeline. You can find it in Sitecore.Owin.Authentication.dll with the full namespace Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.ApplyRedirect.

In there is the following line:

args.Context.Options.Provider.ApplyRedirect(new CookieApplyRedirectContext(args.Context.OwinContext, args.Context.Options, args.StartUrl));

The value of the args.StartUrl is HttpContext.Current.Request.Url.AbsoluteUri. This means that it always redirects to current server URL and ignores the gateway URL. I fixed it by replacing the ApplyRedirect with my own:

public class ApplyRedirect : SignedInProcessor
{
    private IEnumerable<PathString> _loginPaths;

    private readonly IUrlUtils urlUtils;

    private readonly ISitesContext sitesContext;

    public ApplyRedirect(BaseSettings settings, ISitesContext sitesContext, IUrlUtils urlUtils)
    {
        Assert.ArgumentNotNull(settings, nameof(settings));
        this.Settings = settings;

        this.sitesContext = sitesContext;
        this.urlUtils = urlUtils;
    }

    protected BaseSettings Settings { get; }

    private IEnumerable<PathString> LoginPaths => _loginPaths ??= GetLoginPaths();

    public override void Process(SignedInArgs args)
    {
        Assert.ArgumentNotNull(args, nameof (args));
        if (string.IsNullOrWhiteSpace(args.StartUrl))
        {
            return;
        }

        var url = args.Context.Request.Query.Get(args.Context.Options.ReturnUrlParameter);
        if (!string.IsNullOrWhiteSpace(url)
            && args.Context.Request.Path == args.Context.Options.LoginPath
            && !WebUtil.IsExternalUrl(url, args.Context.Request.Host.Value)
            && args.Context.Response.StatusCode == 200
            || !this.LoginPaths.Any(args.Context.OwinContext.Request.Path.StartsWithSegments))
        {
            return;
        }

        var domain = urlUtils.GetDomain();

        var redirectUri = WebUtil.GetUri(url ?? "/", new Uri(domain));

        args.Context.Options.Provider.ApplyRedirect(new CookieApplyRedirectContext(
            args.Context.OwinContext,
            args.Context.Options,
            redirectUri.ToString()));
    }

    private List<PathString> GetLoginPaths()
    {
        return this.sitesContext.GetSites()
            .Select(info => info.LoginPage)
            .Where(s => !string.IsNullOrWhiteSpace(s)).Concat(
                new[]
                {
                    this.Settings.IdentityProcessingPathPrefix().EnsureTrailingSlash() + "externallogincallback",
                    this.Settings.IdentityProcessingPathPrefix().EnsureTrailingSlash() + "loginpassword"
                }).Select(s =>
            {
                try
                {
                    return new PathString(s);
                }
                catch (ArgumentException)
                {
                    throw new ArgumentException("Login page must start with '/'");
                }
            }).ToList();
    }
}

This version is a copy of the Sitecore version, but it gets the domain from a helper. In our helper we check for certain headers that the gateway sends. One of those headers is the gateway domain. If we find that we use that instead of the webserver domain.

You can replace the Sitecore pipeline with your own with this config transform:

<processor type="Project.Foundation.Identity.Pipelines.ApplyRedirect, Project.Foundation.Identity" resolve="true" patch:instead="processor[@type='Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.ApplyRedirect, Sitecore.Owin.Authentication']" />

Now that you have your custom ApplyRedirect it should redirect to the gateway domain.

Answer 2

According to our documentation Azure Application Gateway is not supported on CM instances:

https://doc.sitecore.com/xp/en/developers/102/sitecore-experience-manager/using-azure-application-gateway-to-secure-your-content-delivery-server.html (WAF and Application Gateway are compatible with CDs, they are not compatible with Content Management (CM))

https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0682999#Notes (WAF and Application Gateway are compatible with Content Delivery (CD) servers, they are not compatible with Content Management (CM) servers.)

Solution: We have fixed this issue by setup a custom domain for CM site.