6

I've created a Two Factor Authentication. It's working by adding our custom processor before Sitecore.Pipelines.LoggedIn.Ticket. But now in 9.1 with Identity Server, it won't be triggered unless I disabled Identity Server.

Do you guys have a workaround to add 2FA within Identity Server, or at least interfere login process within Identity Server? Thanks

  • 1
    Sitecore 9.1 uses owin authentication, so look at .\Website\App_Config\Sitecore\Owin.Authentication. It contains the sign in and other related processors like <owin.cookieAuthentication.signedIn help="Processors should derive from Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.SignedInProcessor"> – Gobinath Saminathan Mar 29 at 13:19
  • 1
    After trying to investigate what you @Gobinath said and then found this answer sitecore.stackexchange.com/a/17915/4774, I think I figured out how to make these things works. Thanks. I'm gonna write the answer below – Dika Purnasucita Apr 4 at 9:46
1

I've figured out the answer based on the comment from @Gobinath and answer of this thread.

So, first you must add NEW config for these Owin and IdentityServer stuffs and don't touch your previous version of these processes (before IdentityServer, in my case it's working properly without IS)

<configuration>
<sitecore>
<pipelines>

<owin.cookieAuthentication.signIn>
<processor resolve="true" type="your.SIGN-IN.pipeline, YourDLL" patch:after="processor[@type='Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignIn.UpdateUserProperties, Sitecore.Owin.Authentication']"/>
</owin.cookieAuthentication.signIn>

<owin.cookieAuthentication.signedIn>
<processor resolve="true" type=" your.SIGNED-IN.Pipeline, YourDll" patch:before="processor[@type='Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.CreateTicket, Sitecore.Owin.Authentication']"/>
</owin.cookieAuthentication.signedIn>

</pipelines>
</sitecore>
</configuration>

You can adjust patch:after processor and add more processors for your needs.

Then, on your code you need to inherit SignInProcessor or SignedInProcessor then override Process with SignInArgs/SignedInArgs as parameter.

public class YourSignInProcessor : SignInProcessor
    {
        public override void Process(SignInArgs args)
        {
          add your code here
        }
    }
public class YourSignedInProcessor : SignedInProcessor
    {
        public override void Process(SignedInArgs args)
        {
          add your code here
        }
    }

Since our code use Persist checking (LoggedInArgs.Persist (bool)), I'm not sure where is this persist checking located within SignedInArgs. I just commented out those lines for now. As Sitecore said

Web applications create persistent authentication cookies when a user selects a Remember me option. Authentication through Federated Authentication produces only non-persistent cookies.

For example, if you sign in through an external identity provider without selecting the Remember me option on that provider, then you have to sign in again after the browser session expires.

If you sign in through an external identity provider and you select the Remember me option on that provider, then you will lose your Sitecore authentication cookie when the browser session expires. However, after a quick auto-redirect to the identity provider and back, you are automatically signed-in to Sitecore again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.