Error connecting to ID host: An error occurred while sending the request

Question

I am getting an error when running dotnet sitecore login:

PS C:\projects\MySite> dotnet sitecore login --cm "https://cm.mysite.localhost" --authority "https://id.mysite.localhost" --allow-write true -t
Looking for package [email protected]
Looking for package [email protected]
Finished resolving plugins. Total elapsed resolution time: 100ms
Logging in to environment default...
Logging in to Sitecore. You should see a browser window open shortly.
[InvalidConfigurationException] Error connecting to https://id.mysite.localhost/.well-known/openid-configuration: An error occurred while sending the request.
   at Sitecore.DevEx.Configuration.Authentication.DeviceAuthorizationProvider.RequestAuthorizationAsync() in C:\BA\ca7111d945a16af4\src\Sitecore.DevEx.Configuration\Authentication\DeviceAuthorizationProvider.cs:line 110
   at Sitecore.DevEx.Configuration.Authentication.DeviceAuthorizationProvider.Login() in C:\BA\ca7111d945a16af4\src\Sitecore.DevEx.Configuration\Authentication\DeviceAuthorizationProvider.cs:line 46
   at Sitecore.DevEx.Configuration.Models.EnvironmentConfiguration.Login() in C:\BA\ca7111d945a16af4\src\Sitecore.DevEx.Configuration\Models\EnvironmentConfiguration.cs:line 176
   at Sitecore.DevEx.Client.Tasks.LoginTask.LoginWithDeviceFlow(EnvironmentConfiguration environmentConfiguration) in C:\BA\ca7111d945a16af4\src\Sitecore.DevEx.Client\Tasks\LoginTask.cs:line 143
   at Sitecore.DevEx.Client.Tasks.LoginTask.Execute(LoginTaskOptions options) in C:\BA\ca7111d945a16af4\src\Sitecore.DevEx.Client\Tasks\LoginTask.cs:line 63
   at Sitecore.DevEx.Client.Cli.Subcommands.LoginCommand.Handle(LoginTask task, LoginArgs args) in C:\BA\ca7111d945a16af4\src\Sitecore.DevEx.Client.Cli\Subcommands\LoginCommand.cs:line 34
   at Sitecore.Devex.Client.Cli.Extensibility.Subcommands.SubcommandBase`2.HandleInternal(TArgs args) in C:\BA\ca7111d945a16af4\src\Sitecore.Devex.Client.Cli.Extensibility\Subcommands\SubcommandBase.cs:line 75

All of this was working before and I am unable to determine what the specific issue is.

I am running the following:

• Sitecore ManagementServices 4.0.0 rev. 00411.zip
• dotnet 3.1.426
• Sitecore SXA headless 10.2
• All sites (CM, CD, ID) are hosted via Docker
• Sitecore CLI 4.2.1 (4.2.1-r00505)

When I manually navigate to the supposedly failing endpoint https://id.mysite.localhost/.well-known/openid-configuration I can see that the certificate is valid, no redirects are occurring, and the response body looks valid:

{
    "issuer": "https://id.mysite.localhost",
    "jwks_uri": "https://id.mysite.localhost/.well-known/openid-configuration/jwks",
    "authorization_endpoint": "https://id.mysite.localhost/connect/authorize",
    "token_endpoint": "https://id.mysite.localhost/connect/token",
    "userinfo_endpoint": "https://id.mysite.localhost/connect/userinfo",
    "end_session_endpoint": "https://id.mysite.localhost/connect/endsession",
    "check_session_iframe": "https://id.mysite.localhost/connect/checksession",
    "revocation_endpoint": "https://id.mysite.localhost/connect/revocation",
    "introspection_endpoint": "https://id.mysite.localhost/connect/introspect",
    "device_authorization_endpoint": "https://id.mysite.localhost/connect/deviceauthorization",
    "frontchannel_logout_supported": true,
    "frontchannel_logout_session_supported": true,
    "backchannel_logout_supported": true,
    "backchannel_logout_session_supported": true,
    "scopes_supported": [
        "openid",
        "profile",
        "email",
        "sitecore.profile",
        "sitecore.profile.api",
        "offline_access"
    ],
    "claims_supported": [
        "sub",
        "name",
        "family_name",
        "given_name",
        "middle_name",
        "nickname",
        "preferred_username",
        "profile",
        "picture",
        "website",
        "gender",
        "birthdate",
        "zoneinfo",
        "locale",
        "updated_at",
        "email",
        "email_verified",
        "role",
        "http://www.sitecore.net/identity/claims/isAdmin",
        "http://www.sitecore.net/identity/claims/originalIssuer"
    ],
    "grant_types_supported": [
        "authorization_code",
        "client_credentials",
        "refresh_token",
        "implicit",
        "password",
        "urn:ietf:params:oauth:grant-type:device_code"
    ],
    "response_types_supported": [
        "code",
        "token",
        "id_token",
        "id_token token",
        "code id_token",
        "code token",
        "code id_token token"
    ],
    "response_modes_supported": [
        "form_post",
        "query",
        "fragment"
    ],
    "token_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post",
        "private_key_jwt"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "subject_types_supported": [
        "public"
    ],
    "code_challenge_methods_supported": [
        "plain",
        "S256"
    ],
    "request_parameter_supported": true
}

On my ID container, the logs don't show any issues:

2024-03-12 09:38:55 [09:38:55] Microsoft.AspNetCore.Hosting.Diagnostics [Information] Request starting HTTP/1.1 GET http://id.mysite.localhost/.well-known/openid-configuration  

2024-03-12 09:38:55 [09:38:55] IdentityServer4.Hosting.IdentityServerMiddleware [Information] Invoking IdentityServer endpoint: "IdentityServer4.Endpoints.DiscoveryEndpoint" for "/.well-known/openid-configuration"

2024-03-12 09:38:55 [09:38:55] Microsoft.AspNetCore.Hosting.Diagnostics [Information] Request finished in 1.3414ms 200 application/json; charset=UTF-8

I know that I have all of the prerequisites in place because I have ran:

dotnet tool restore
dotnet sitecore init
dotnet sitecore login --cm "https://cm.mysite.localhost/" --auth "https://id.mysite.localhost/" --allow-write true

My dotnettools.json is:

{
  "version": 1,
  "isRoot": true,
  "tools": {
    "sitecore.cli": {
      "version": "4.2.1",
      "commands": [
        "sitecore"
      ]
    }
  }
}

I tried the following to re-auth:

• Manually log out of and back into CM using admin credentials
• Clear values from accessToken and refreshToken in user.json
• Delete user.json file entirely
• Clear browser cache and cookies on ID site
• Flush DNS
• Restart all containers
• Clear browser history
• Add "dns": ["8.8.8.8"] to Docker configuration
• Tried it on another machine -- unable to reproduce the issue
• Set insecure to true in user.json file
• Cleared .sitecore files and reinitialized

One issue I have seen recently is that certain actions redirect me to the http CM site rather than https, to which the connection is refused. I can reliably reproduce this by logging out of CM, at which point a call is made to https://cm.mysite.localhost/identity/postexternallogout?nonce=b19bd38690314aeda5d305cb31e1317d&ReturnUrl=http%3a%2f%2fcm.mysite.localhost%2fidentity%2flogin%2fshell%2fSitecoreIdentityServer (notice the http instead of https).

The id Docker logs show this:

2024-03-12 11:19:06 [11:19:06] Microsoft.AspNetCore.Hosting.Diagnostics [Information] Request starting HTTP/1.1 GET http://id.mysite.localhost/connect/endsession?post_logout_redirect_uri=https%3A%2F%2Fcm.mysite.localhost%2Fidentity%2Fpostexternallogout%3Fnonce%3D547481361ffc4aa89de8a3d0f7eccc33%26ReturnUrl%3Dhttp%253a%252f%252fcm.mysite.localhost%252fidentity%252flogin%252fshell%252fSitecoreIdentityServer%253fsc_bw%253d1&id_token_hint=eyJhbGciOiJSUzI1NiIsImtpZCI6IjFDMzRBQkQ4MUQwMTM1Q0I1ODE3NDY2QzIzMTIzM0M2RUVEMzhGNTFSUzI1NiIsInR5cCI6IkpXVCIsIng1dCI6IkhEU3IyQjBCTmN0WUYwWnNJeEl6eHU3VGoxRSJ9.eyJuYmYiOjE3MTAyNjMzOTMsImV4cCI6MTcxMDI2NDg5MywiaXNzIjoiaHR0cHM6Ly9pZC5uaXhvbnBlYWJvZHkubG9jYWxob3N0IiwiYXVkIjoiU2l0ZWNvcmUiLCJub25jZSI6IjYzODQ1ODYwMTg4NDUzNzczNC5ZamN3WTJKaE5HUXRabUUyTlMwME1UTTFMV0ZsWVRJdE5tRTNPRGRrWVRVME9EWXpZVEkzTWpGaFl6SXRNMkUzTVMwME0ySXhMVGd6WVdFdFpXSmlOMk15WmpObE5XTm0iLCJpYXQiOjE3MTAyNjMzOTMsImF0X2hhc2giOiI0Y3JsanhjMUV0ZHlQVk1FMl93VzF3IiwiY19oYXNoIjoiQ2JVRFJUQy1uTDA3Rm9YaTVZTWx5ZyIsInNfaGFzaCI6ImlUMTNGYUs5WFk2eFRuYUo4cTZKaUEiLCJzaWQiOiJDRUMwNTUyQzVDNTNCQzVDNDc0QzUyMTYyRjg0MDQyNCIsInN1YiI6ImM0M2E1MTdlOTE4MjRmZTRiNGE2MGUxZjEzYzRmMTU1IiwiYXV0aF90aW1lIjoxNzEwMjYzMzkzLCJpZHAiOiJsb2NhbCIsImFtciI6WyJwd2QiXX0.IO7svYjVNt1URpOA7euBchCFhWpDxTOSJLVx3uAmGRS8TiGx7njWhNhezQnaw-9r7WWJMvlMX463EA0ipp-GTHR9BZ3w1r-Wbh7RO1mO2YFGE8q1rTqC1Pytt7_NIKKEehUfj_DJWpe1ApJl-7EH9LKCBuqcDlCWtBQIFExwjVYMl2w-Ficrc-dbzC5rEBWoppnZquQLs9KJddE7QHGme3CpzLeGE4L027A_wUUnckEMVvJqiv1Ly2GVUIjvQgA_pgdIGzo1U8tbajJoBLNXG-5ozaCRSbJvnPoVU4Dkf1t8J8BJ7hou1H-AnbvE68gTr5moxLUkZG0vhbSGx5qgUg&x-client-SKU=ID_NET461&x-client-ver=5.3.0.0  
2024-03-12 11:19:06 [11:19:06] IdentityServer4.Hosting.IdentityServerMiddleware [Information] Invoking IdentityServer endpoint: "IdentityServer4.Endpoints.EndSessionEndpoint" for "/connect/endsession"
2024-03-12 11:19:06 [11:19:06] IdentityServer4.Validation.EndSessionRequestValidator [Information] End session request validation success
2024-03-12 11:19:06 EndSessionRequestValidationLog {ClientId="Sitecore", ClientName="Sitecore", SubjectId="c43a517e91824fe4b4a60e1f13c4f155", PostLogOutUri="https://cm.mysite.localhost/identity/postexternallogout?nonce=547481361ffc4aa89de8a3d0f7eccc33&ReturnUrl=http%3a%2f%2fcm.mysite.localhost%2fidentity%2flogin%2fshell%2fSitecoreIdentityServer%3fsc_bw%3d1", State=null, Raw={["post_logout_redirect_uri"]="https://cm.mysite.localhost/identity/postexternallogout?nonce=547481361ffc4aa89de8a3d0f7eccc33&ReturnUrl=http%3a%2f%2fcm.mysite.localhost%2fidentity%2flogin%2fshell%2fSitecoreIdentityServer%3fsc_bw%3d1", ["id_token_hint"]="***REDACTED***", ["x-client-SKU"]="ID_NET461", ["x-client-ver"]="5.3.0.0"}}
2024-03-12 11:19:06 [11:19:06] Microsoft.AspNetCore.Hosting.Diagnostics [Information] Request finished in 6.6267ms 302 
2024-03-12 11:19:06 [11:19:06] Microsoft.AspNetCore.Hosting.Diagnostics [Information] Request starting HTTP/1.1 GET http://id.mysite.localhost/Account/Logout?logoutId=CfDJ8MlruGwz0zNPpoIZkNeZBloVlWDoECo3fkiHU01_F1gDvuBmAtucXSd6vcgRPPRIux65uXjEsJbq_S7WgO2TJyYDbPpBizg_xi0VjkoizaRxzhJ7LkjwR-QUnUiMIUU7IM1o3Zjxl1sH8L_UBYyE4wU0rPZ1Bmh1msupWIRRkJIn3SikkeuPGjpwZaZ9NoaDTwCA61Vx2sTsCRQelbiTCacxX3I7PeynJjCgc3tO16YAGRwmgvjoHnwliApG3KddZR2Ef72QWHrWVAxE0IyldAwPAbnUt8GieDxp0LFBS9IH3HyoMVsrQG4VD2fXtTobyxKa2ksw5VdMjBdFvPes3M5_c3s-UkZxQ3trUh9G8H8sPOUq44ok-Ye6sf6Vv-yEsUfR0UImiETQTxNw1j4Z9Ntr9tgo5EX-3cKT_lL7dI5aPnXovzqmIYPIpcfv59s5gjg-8rPe-KkjWUxsGxaCilSaVc_mp2_JGqy9mKc7CW0Yjbe_sGpuiIDMZLvvS8fXQmvwB7FyZucWor2NbjjRDuWq7CBSG53utDUMSoq3GEDMLDcNyxkPuJQNQtREjTtQWXWPiLv--hJIto6HNvT1p_R0eXpOMfY6GHGqClnTezEvbv_BsrMJX_04Obh7xbmHfpqvKVTvyZNZ3k02wa6dQNMwbqidJfpr3z3pMMZOPsGCGUGc3_JQv0FOH-X_EOW2WCayxBmvqZHA4p3mzF7mCtbw7UaHGqi395c-9I9OrGU9VY35l0I2EfoQvuG5QhxGXQN_gL09RZQYU2HblAmBBDktemxUkP6fNPhhsDonBy4F  
2024-03-12 11:19:06 [11:19:06] Microsoft.AspNetCore.Routing.EndpointMiddleware [Information] Executing endpoint '"Sitecore.Plugin.IdentityServer.Controllers.AccountController.Logout (Sitecore.Plugin.IdentityServer)"'
2024-03-12 11:19:06 [11:19:06] Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker [Information] Route matched with "{action = \"Logout\", controller = \"Account\"}". Executing controller action with signature "System.Threading.Tasks.Task`1[Microsoft.AspNetCore.Mvc.IActionResult] Logout(System.String)" on controller "Sitecore.Plugin.IdentityServer.Controllers.AccountController" ("Sitecore.Plugin.IdentityServer").
2024-03-12 11:19:06 [11:19:06] Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler [Information] AuthenticationScheme: "idsrv" signed out.
2024-03-12 11:19:06 [11:19:06] Microsoft.AspNetCore.Mvc.ViewFeatures.ViewResultExecutor [Information] Executing ViewResult, running view "LoggedOut".
2024-03-12 11:19:06 [11:19:06] Microsoft.AspNetCore.Mvc.ViewFeatures.ViewResultExecutor [Information] Executed ViewResult - view "LoggedOut" executed in 5.1378ms.
2024-03-12 11:19:06 [11:19:06] Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker [Information] Executed action "Sitecore.Plugin.IdentityServer.Controllers.AccountController.Logout (Sitecore.Plugin.IdentityServer)" in 13.2591ms
2024-03-12 11:19:06 [11:19:06] Microsoft.AspNetCore.Routing.EndpointMiddleware [Information] Executed endpoint '"Sitecore.Plugin.IdentityServer.Controllers.AccountController.Logout (Sitecore.Plugin.IdentityServer)"'
2024-03-12 11:19:06 [11:19:06] Microsoft.AspNetCore.Hosting.Diagnostics [Information] Request finished in 16.8808ms 200 text/html; charset=utf-8
2024-03-12 11:19:06 [11:19:06] Microsoft.AspNetCore.Hosting.Diagnostics [Information] Request starting HTTP/1.1 GET http://id.mysite.localhost/connect/endsession/callback?endSessionId=CfDJ.....
2024-03-12 11:19:06 [11:19:06] IdentityServer4.Hosting.IdentityServerMiddleware [Information] Invoking IdentityServer endpoint: "IdentityServer4.Endpoints.EndSessionCallbackEndpoint" for "/connect/endsession/callback"
2024-03-12 11:19:06 [11:19:06] IdentityServer4.Endpoints.EndSessionCallbackEndpoint [Information] Successful signout callback.
2024-03-12 11:19:06 [11:19:06] Microsoft.AspNetCore.Hosting.Diagnostics [Information] Request finished in 2.6068ms 200 text/html; charset=UTF-8
2024-03-12 11:19:36 [11:19:36] Microsoft.AspNetCore.Hosting.Diagnostics [Information] Request starting HTTP/1.1 GET http://localhost/healthz/live  0
2024-03-12 11:19:36 [11:19:36] Microsoft.AspNetCore.Hosting.Diagnostics [Information] Request finished in 0.372ms 200 text/plain

A potentially notable value in there is client-ver=5.3.0.0. If it's what I think it is, it's the wrong version.

Something similar happens when I log in -- I get redirected to http via this call after pressing log in: https://cm.mysite.localhost/identity/externallogincallback?ReturnUrl=&sc_site=shell&authenticationSource=Default, wherby the response sets the browser location to http://cm.mysite.localhost/sitecore/client/Applications/Launchpad?sc_lang=en.

Even if I just navigate to https://cm.mysite.localhost/sitecore, I get redirected to http://cm.mysite.localhost/sitecore/client/Applications/Launchpad?sc_lang=en. To actually get the page to load, I need to manually adjust http to https.

How can I troubleshoot further / fix this?

Answer 1

In the docker-compose.yml and docker-compose.override.yml files, check the environment variables defined for id.

Make sure they are all pointing to the https URLs.

Also, check your .env file, and confirm if any variables use HTTP instead of https.

Answer 2

I was not able to determine the root cause of the issue. The only way I was able to get this working was by upgrading to a newer version of Sitecore CLI (5.2.113). I spoke with Sitecore support and that was their recommended solution as well.

Recommendation: update from Sitecore CLI version 4.x ASAP so that this does not become a blocker for you.