2

I've got federated authentication set up for Azure AD. I am using Sitecore 9.0.1 on Azure App Service. I ran into an odd problem when going into Experience Editor that I can't duplicate with a "local" user that has the same permissions (seemingly).

When my Azure AD user logs in, they're given the Author, Designer, and Client Publishing permissions, via two groups (an Authors and Publishers group) that they're a member. This gives them access to Experience Editor. When I go in there, I get an

Uncaught SyntaxEditor: Unexpected token <

message in the browser console, related to /Sitecore/login?ReturnUrl=%2f-%2fspeak%2fv1%2fassets%2fmain.js.

If I set up a user through User Manager and assign the same roles, then log in with them, I don't get the same error.

It looks like something isn't triggered right in the login process for Azure AD and the system thinks I shouldn't have access to the /-/speak/v1/assets/main.js file. Without that, the Experience Editor just keeps spinning...I get the title bar and I can see a placeholder, but I can't access any of it because the "loading" modal is there.

If there's additional information I can provide, please let me know.

Improve this question
2
  • We had some issues with OKTA and Sitecore 8.2. Preview mode would break with an error. Which came from Sitecore.Web.Authentication.DefaultTicketManager.HasAccessForLogin Are you able to see a stack trace to see any more detailed errors ? We ended up getting Sitecore support to replicate the issue and provide a patch.
    – TomT
    Commented Mar 20, 2018 at 0:08
  • No stack trace, the error's coming up as a login redirect for a script file that's needed. But no YSOD and nothing I could see in the logs. I sent them my fed auth scripts to try and replicate what I'm seeing.
    – Ken McAndrew
    Commented Mar 20, 2018 at 17:52

1 Answer 1

Reset to default
3

Sitecore Support provided a solution for this. Basically it was to swap the position of two pipeline calls in the owin.cookieAuthentication.validateIdentity pipeline. I've put this patch into my solution and validated it worked:

<pipelines>
  <owin.cookieAuthentication.validateIdentity>
    <patch:delete/>
  </owin.cookieAuthentication.validateIdentity>

  <owin.cookieAuthentication.validateIdentity help="Processors should derive from Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.ValidateIdentity.ValidateIdentityProcessor" patch:after="owin.identityProviders">
    <processor type="Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.ValidateIdentity.ValidateForUnresolvedSiteContext, Sitecore.Owin.Authentication" />
    <processor type="Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.ValidateIdentity.ResolveToDefaultAuthenticationSourceOnly, Sitecore.Owin.Authentication">
      <paths hint="list">
      </paths>
    </processor>
    <processor type="Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.ValidateIdentity.CheckIdentityProvider, Sitecore.Owin.Authentication" resolve="true" />
    <processor type="Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.ValidateIdentity.CheckSiteMode, Sitecore.Owin.Authentication" resolve="true" />
  </owin.cookieAuthentication.validateIdentity>
</pipelines>
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.