Issue elevating SPE Console in 9.1 Azure PaaS

Question

I have a relatively clean install of Sitecore PowerShell Extensions v 5.0 in my environment, which is running Sitecore 9.1 on Azure PaaS. As far as I can tell, everything in the install seems to be working fine, except elevating permissions to run scripts in the Console. When I attempt to elevate permissions, I see an excessive number of network requests (3k+) flow through the browser, the window locks up, and I eventually have to kill the tab.

I am seeing this issue on both the XP-Single and XP-Scaled topologies. When I check the logs, it is showing that the session was elevated, however I cannot use it (even after refreshing the browser).

I attempted to re-install the module, but this did not resolve the issue.

Any ideas as to what might be causing those two requests to repeatedly fire?

UPDATE:

I pulled down the Git repo, and did the ol' add logging trick. It looks like the context of the authentication attempt for the console is coming through as an anonymous user, instead of the currently logged in user:

Local Environment (working):

13288 13:24:03 ERROR User is logged in: True 13288 13:24:03 ERROR User is authorized from manager: True for user sitecore\admin 13288 13:24:03 ERROR User is authorized: True 13288 13:24:03 ERROR Session is elevated: False 13360 13:24:05 WARN Session state elevated for 'Console' by user: sitecore\admin 1988 13:24:05 ERROR User is logged in: True 1988 13:24:05 ERROR User is authorized from manager: True for user sitecore\admin 1988 13:24:05 ERROR User is authorized: True 1988 13:24:05 ERROR Session is elevated: True

Non-Local Environment (not working):

21180 20:26:39 ERROR User is logged in: False 21180 20:26:39 ERROR User is authorized from manager: False for user extranet\Anonymous 21180 20:26:39 ERROR User is authorized: False 21180 20:26:39 ERROR Session is elevated: False 13220 20:26:46 WARN Session state elevated for 'Console' by user: sitecore\xcadmin 11464 20:26:47 ERROR User is logged in: False 11464 20:26:47 ERROR User is authorized from manager: False for user extranet\Anonymous 11464 20:26:47 ERROR User is authorized: False 11464 20:26:47 ERROR Session is elevated: True

Here is the snippet I modified:

[WebMethod(EnableSession = true)]
public object ExecuteCommand(string guid, string command, string stringFormat)
{
    var serializer = new JavaScriptSerializer();
    var output = new StringBuilder();

    var isSessionElevated = SessionElevationManager.IsSessionTokenElevated(ApplicationNames.Console);

    Log.Error($"User is logged in: {Sitecore.Context.IsLoggedIn}", this);
    Log.Error($"User is authorized from manager: {ServiceAuthorizationManager.IsUserAuthorized(WebServiceSettings.ServiceClient, Sitecore.Context.User?.Name)} for user {Sitecore.Context.User?.Name}", this);
    Log.Error($"User is authorized: {IsLoggedInUserAuthorized}", this);
    Log.Error($"Session is elevated: {isSessionElevated}", this);


    if (!IsLoggedInUserAuthorized || !isSessionElevated)
    {
        return serializer.Serialize(
            new
            {
                status = StatusElevationRequired,
                result =
                "You need to be authenticated, elevated and have sufficient privileges to use the PowerShell console. Please (re)login to Sitecore.",
                prompt = "PS >",
                background = OutputLine.ProcessHtmlColor(ConsoleColor.DarkBlue)
            });
    }

    ...
}

Answer 1

I recently discovered this issue on my local instance of SPE while working on 5.1. Corey Smith showed me how to resolve this issue as it recently came up with Unicorn.

Apply the following patch for instances of Sitecore (9.1+) to fix the issue.

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/" xmlns:security="http://www.sitecore.net/xmlconfig/security/">
  <sitecore role:require="Standalone or ContentManagement" security:require="Sitecore">
    <pipelines>
      <owin.cookieAuthentication.validateIdentity>
        <processor type="Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.ValidateIdentity.ValidateSiteNeutralPaths, Sitecore.Owin.Authentication">
          <siteNeutralPaths hint="list">
            <path hint="spe">/sitecore%20modules/PowerShell</path>
          </siteNeutralPaths>
        </processor>
      </owin.cookieAuthentication.validateIdentity>
    </pipelines>
  </sitecore>
</configuration>

Note: This configuration is included with SPE 5.1. Enable the configuration file when using Sitecore 9.1+.

Answer 2

The fix for this has been moved for Sitecore 9.3+ (including Sitecore 10). To resolve it now, you have to go to:

\App_Config\Include\Spe

and rename

Spe.IdentityServer.config.disabled

to

Spe.IdentityServer.config