Installing 9.1 XP0 - Sorry, there was an error : unauthorized_client

Question

After installing 9.1 I see the following error on the login screen:

Steps I followed:

1. Updated XP0-SingleDeveloper with ".dev.sc.local" to the site names
2. Ran the installation using XP0-SingleDeveloper.ps1 and SIF 2.0
3. Updated IIS host binding to use https for "sc910.dev.sc.local".

Update

While setting up a new 10.2 instance I encountered the error "invalid_request". This was caused by the AllowedCorsOrigins not containing the correct url. The log messages in Identity showed something like the following:

Invalid redirect_uri: "https://scmsx.int.sxp.local/identity/signin"

Turns out I mistakenly put the wrong url in the Sitecore.IdentityServer.Host.xml file.

<?xml version="1.0" encoding="utf-8" ?>
<Settings>
  <Sitecore>
    <IdentityServer>          
      <Clients>
        <DefaultClient>
          <AllowedCorsOrigins>
            <!-- This should show scmsx instead of identityx -->
            <AllowedCorsOriginsGroup1>https://identityx.int.sxp.local</AllowedCorsOriginsGroup1>
          </AllowedCorsOrigins>
        </DefaultClient>
      </Clients>
    </IdentityServer>
  </Sitecore>
</Settings>

Answer 1

After speaking with my friend @kamsar, he pointed out the CORS origin on the Identity Server Instance needs an update.

The Identity Server doesn't allow logging in from just any url, for security reasons.

• Open the file C:\inetpub\wwwroot\sc910.identityserver.dev.sc.local\Config\production\Sitecore.IdentityServer.Host.xml
• Add a new AllowedCorsOriginsGroupN (optionally use a pipe delimiter pointed out by @monkey-dsc)
• Recycle the Identity Server Application Pool

Below you can see the new setting added as Group2:

<AllowedCorsOrigins>
  <AllowedCorsOriginsGroup1>http://sc910.dev.sc.local</AllowedCorsOriginsGroup1>
  <AllowedCorsOriginsGroup2>https://sc910.dev.sc.local</AllowedCorsOriginsGroup2>
</AllowedCorsOrigins>

Resources

• Found this link to the 9.1 documentation
• Configuration patching for Sitecore Host

Answer 2

In addition to Michaels correct answer: It is also possible to define the AllowedCorsOrigins pipe-separated. I also stuck on this and found the description in the IdentityServer WDP zip (parameters.xml):

    <parameter name="AllowedCorsOrigins" description="Pipe-separated list of instances (URIs) that are allowed to login via Sitecore Identity.">
      <parameterEntry kind="TextFile" scope="website\\config\\production\\Sitecore.IdentityServer.Host\.xml" match="PlaceholderForClientOriginsGroup" />
    </parameter>

You can define the Origins like that:

      <AllowedCorsOrigins>
        <AllowedCorsOriginsGroup1>http://sc910.dev.sc.local|https://sc910.dev.sc.local</AllowedCorsOriginsGroup1>
        <AllowedCorsOriginsGroup2>http://otherhost.dev.sc.local|https://otherhost.dev.sc.local</AllowedCorsOriginsGroup2>
      </AllowedCorsOrigins>

Answer 3

I tried using https instead of http to access my local sitecore admin panel like this

https://site.local/sitecore and it worked remember every request in sitecore 9.1 needs to be in secure SSL so use only https ! Hope it helps someone.