CM to Identity Server redirection issue

Question

I'm running the Content Management (CM) and Sitecore Identity Server (SIS) roles on a single AWS EC2 instance.

This is behind an AWS application load balancer, which accepts traffic on port 443 only and forwards it to these applications on port 80.

When the CM application redirects to the SIS application as part of the authentication flow, it's telling SIS its address is http://... as it only knows that it's running on port 80, and has no knowledge of the infrastructure in front of it. An example of the redirect URL is:

https://cm-91.sc/connect/authorize? ...&redirect_uri=http%3A%2F%2Fcm-91.sc%2Fidentity%2Fsignin...

This causes SIS to error because of an unauthorized client.

I can get around this, by adding both the HTTP and HTTPS addresses to the CORS allowed origins, which is not ideal, but is a workable solution.

However, after providing a valid username and password to SIS, the flow back to the CM application breaks because it's trying to redirect back to a HTTP address.

Is there a way to force the Sitecore CM application to generate self URLs with a HTTPS scheme?

Answer 1

You can solve the problem by simply forcing all requests on the CM to be on HTTPS by using the following IIS rewrite rule on your CM instance web.config

<rule name="HTTP/S to HTTPS Redirect" stopProcessing="true">
  <match url="(.*)" />
  <conditions logicalGrouping="MatchAny">
    <add input="{SERVER_PORT_SECURE}" pattern="^0$" />
  </conditions>
  <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Permanent" />
</rule>