2

I have an environment running in Azure PaaS using Sitecore 9.1 (initial release), and after a while I couldn't sign in to the CM anymore.

Invalid Username or password

I decide to restart the App Service, and once SI back up, the CM was able to handle my account and allowed me to sign in again.

SI logs shows the following but unfortunately it does not lead to anywhere

2019-05-01T14:09:54.6906645+00:00 [DBG] (Sitecore STS/RD00155D474051) IsActive called from: "UserInfoRequestValidation"
2019-05-01T14:09:54.7012805+00:00 [DBG] (Sitecore STS/RD00155D474051) Creating userinfo response
2019-05-01T14:09:54.7168138+00:00 [DBG] (Sitecore STS/RD00155D474051) Scopes in access token: "openid sitecore.profile"
2019-05-01T14:09:54.7210291+00:00 [DBG] (Sitecore STS/RD00155D474051) Scopes in access token: "openid sitecore.profile"
2019-05-01T14:09:54.7279337+00:00 [DBG] (Sitecore STS/RD00155D474051) Requested claim types: "sub name email role http://www.sitecore.net/identity/claims/isAdmin http://www.sitecore.net/identity/claims/originalIssuer"
2019-05-01T14:09:54.7296263+00:00 [DBG] (Sitecore STS/RD00155D474051) Scopes in access token: "openid sitecore.profile"
2019-05-01T14:09:54.7310852+00:00 [DBG] (Sitecore STS/RD00155D474051) Get profile called for subject "0eGDss7ipEMQPH3TLHo5GzoRSyYU3VQpmumHxGOu4OI" from client "Sitecore" with claim types ["sub", "name", "email", "role", "http://www.sitecore.net/identity/claims/isAdmin", "http://www.sitecore.net/identity/claims/originalIssuer"] via "UserInfoEndpoint"
2019-05-01T14:09:54.7351295+00:00 [DBG] (Sitecore STS/RD00155D474051) Untransformed claims: ["aio", "http://schemas.microsoft.com/claims/authnmethodsreferences", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname", "groups", "groups", "groups", "groups", "groups", "groups", "groups", "groups", "groups", "groups", "groups", "groups", "groups", "groups", "groups", "groups", "groups", "name", "http://schemas.microsoft.com/identity/claims/objectidentifier", "onprem_sid", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", "http://schemas.microsoft.com/identity/claims/tenantid", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn", "uti", "http://www.sitecore.net/identity/claims/originalIssuer", "idp"]
2019-05-01T14:09:54.8023645+00:00 [DBG] (Sitecore STS/RD00155D474051) Issued claims: ["name", "http://www.sitecore.net/identity/claims/originalIssuer", "email"]
2019-05-01T14:09:54.8035940+00:00 [INF] (Sitecore STS/RD00155D474051) Profile service returned to the following claim types: "name http://www.sitecore.net/identity/claims/originalIssuer email"
2019-05-01T14:09:54.8048942+00:00 [DBG] (Sitecore STS/RD00155D474051) End userinfo request
2019-05-01T14:09:54.8087227+00:00 [DBG] (Sitecore STS/RD00155D474051) Connection id ""0HLME0D4ISLCE"" completed keep alive response.
2019-05-01T14:09:54.8099743+00:00 [INF] (Sitecore STS/RD00155D474051) Request finished in 205.7899ms 200 application/json; charset=UTF-8
2019-05-01T14:09:56.0776989+00:00 [INF] (Sitecore STS/RD00155D474051) Request starting HTTP/1.1 GET http://qa-si.domain.com/connect/authorize?client_id=Sitecore&response_mode=form_post&response_type=code%20id_token%20token&scope=openid%20sitecore.profile&state=OpenIdConnect.AuthenticationProperties%3DeDjL-7xv-jugI8khJK3fVTFoglOOwYauZRQvlDf9TdddYvm_AY8mHBAsBzt0AJyHgu_zBmsfrjlr0rzaSwzoteW2ulL0h909umY5-6vUdr_62eFQYjjguKiCHdmszuUs9hDqZoT0PRI4hEnDsdPwKUV-dF-LZ9AtGsMWaz4SlVEpqCMmmk8T2zqU1KGiSXpScfns4YxuTNGFPx9IBapEJg&nonce=636923165960371377.YmEzMDIxMDgtYmFlMC00ZGU5LTkzOTQtOGI3NWFiMzY4NjJkNTcxYTI5MGUtMzQ0My00YTcwLThkZWUtOTU5OTdjZGVhZjUw&redirect_uri=https%3A%2F%2Fqacm.domain.com%2Fidentity%2Fsignin&sc_account_prefix=sitecore%5C&prompt=login&sc_message=You%20do%20not%20have%20access%20to%20the%20system.%20If%20you%20think%20this%20is%20wrong%2C%20please%20contact%20the%20system%20administrator.&x-client-SKU=ID_NET451&x-client-ver=5.2.2.0  
2019-05-01T14:09:56.0801569+00:00 [DBG] (Sitecore STS/RD00155D474051) AuthenticationScheme: "idsrv" was successfully authenticated.
2019-05-01T14:09:56.0812324+00:00 [DBG] (Sitecore STS/RD00155D474051) AuthenticationScheme: "idsrv" was successfully authenticated.
2019-05-01T14:09:56.0822691+00:00 [DBG] (Sitecore STS/RD00155D474051) Request path "/connect/authorize" matched to endpoint type "Authorize"
2019-05-01T14:09:56.0891315+00:00 [DBG] (Sitecore STS/RD00155D474051) Endpoint enabled: "Authorize", successfully created handler: "IdentityServer4.Endpoints.AuthorizeEndpoint"
2019-05-01T14:09:56.0901824+00:00 [INF] (Sitecore STS/RD00155D474051) Invoking IdentityServer endpoint: "IdentityServer4.Endpoints.AuthorizeEndpoint" for "/connect/authorize"
2019-05-01T14:09:56.0912454+00:00 [DBG] (Sitecore STS/RD00155D474051) Start authorize request
2019-05-01T14:09:56.0924935+00:00 [DBG] (Sitecore STS/RD00155D474051) User in authorize request: "0eGDss7ipEMQPH3TLHo5GzoRSyYU3VQpmumHxGOu4OI"
2019-05-01T14:09:56.0986399+00:00 [DBG] (Sitecore STS/RD00155D474051) Start authorize request protocol validation
2019-05-01T14:09:56.1000479+00:00 [DBG] (Sitecore STS/RD00155D474051) client configuration validation for client "Sitecore" succeeded.
2019-05-01T14:09:56.1012558+00:00 [DBG] (Sitecore STS/RD00155D474051) Checking for PKCE parameters
2019-05-01T14:09:56.1025272+00:00 [DBG] (Sitecore STS/RD00155D474051) No PKCE used.
2019-05-01T14:09:56.1043570+00:00 [DBG] (Sitecore STS/RD00155D474051) Calling into custom validator: "IdentityServer4.Validation.DefaultCustomAuthorizeRequestValidator"
2019-05-01T14:09:56.1085712+00:00 [INF] (Sitecore STS/RD00155D474051) ValidatedAuthorizeRequest
"{
  \"ClientId\": \"Sitecore\",
  \"ClientName\": \"Sitecore\",
  \"RedirectUri\": \"https://qacm.domain.com/identity/signin\",
  \"AllowedRedirectUris\": [
    \"{AllowedCorsOrigin}/identity/signin\",
    \"{AllowedCorsOrigin}/signin-oidc\"
  ],
  \"SubjectId\": \"0eGDss7ipEMQPH3TLHo5GzoRSyYU3VQpmumHxGOu4OI\",
  \"ResponseType\": \"code id_token token\",
  \"ResponseMode\": \"form_post\",
  \"GrantType\": \"hybrid\",
  \"RequestedScopes\": \"openid sitecore.profile\",
  \"State\": \"OpenIdConnect.AuthenticationProperties=eDjL-7xv-jugI8khJK3fVTFoglOOwYauZRQvlDf9TdddYvm_AY8mHBAsBzt0AJyHgu_zBmsfrjlr0rzaSwzoteW2ulL0h909umY5-6vUdr_62eFQYjjguKiCHdmszuUs9hDqZoT0PRI4hEnDsdPwKUV-dF-LZ9AtGsMWaz4SlVEpqCMmmk8T2zqU1KGiSXpScfns4YxuTNGFPx9IBapEJg\",
  \"Nonce\": \"636923165960371377.YmEzMDIxMDgtYmFlMC00ZGU5LTkzOTQtOGI3NWFiMzY4NjJkNTcxYTI5MGUtMzQ0My00YTcwLThkZWUtOTU5OTdjZGVhZjUw\",
  \"PromptMode\": \"login\",
  \"SessionId\": \"68da5dbc3fed75c40faeedaf67166d32\",
  \"Raw\": {
    \"client_id\": \"Sitecore\",
    \"response_mode\": \"form_post\",
    \"response_type\": \"code id_token token\",
    \"scope\": \"openid sitecore.profile\",
    \"state\": \"OpenIdConnect.AuthenticationProperties=eDjL-7xv-jugI8khJK3fVTFoglOOwYauZRQvlDf9TdddYvm_AY8mHBAsBzt0AJyHgu_zBmsfrjlr0rzaSwzoteW2ulL0h909umY5-6vUdr_62eFQYjjguKiCHdmszuUs9hDqZoT0PRI4hEnDsdPwKUV-dF-LZ9AtGsMWaz4SlVEpqCMmmk8T2zqU1KGiSXpScfns4YxuTNGFPx9IBapEJg\",
    \"nonce\": \"636923165960371377.YmEzMDIxMDgtYmFlMC00ZGU5LTkzOTQtOGI3NWFiMzY4NjJkNTcxYTI5MGUtMzQ0My00YTcwLThkZWUtOTU5OTdjZGVhZjUw\",
    \"redirect_uri\": \"https://qacm.domain.com/identity/signin\",
    \"sc_account_prefix\": \"sitecore\\\",
    \"prompt\": \"login\",
    \"sc_message\": \"You do not have access to the system. If you think this is wrong, please contact the system administrator.\",
    \"x-client-SKU\": \"ID_NET451\",
    \"x-client-ver\": \"5.2.2.0\"
  }
}"
2
  • "You do not have access to the system. If you think this is wrong, please contact the system administrator."... I'm wondering how an AppService restart would fix that? Indeed it's really weird... Commented May 2, 2019 at 19:36
  • 1
    Next time it happens make sure you're not hitting the concurrent user limit for your licence by clicking forgot password (it should take you to kickuser.aspx) Commented May 2, 2019 at 23:25

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.