3

I'm going through the security hardening steps on a new, local instance of Sitecore 9.1.1 with identity server. I made the SHA512 change in the Sitecore web.config, and I ran the database script to reset the password/salt appropriately:

UPDATE aspnet_Membership
SET Password = 'K8N8GUW8UiNT2mPdjvuBDH+QmvA3R61M9buVvCwFHwtDjpMzTxs34lg0uQ0azCITqh6FkUZlX4kM72lsAyuyXQ==', 
PasswordSalt = 'p5B6HOWKt0ctMZaSNXTlfw=='
FROM aspnet_Membership m INNER JOIN aspnet_Users u ON m.UserId = u.UserId
WHERE u.UserName = 'sitecore\Admin'

However, I still cannot log into the CM. I'm guessing something else needs changing on the identity server side, but I don't see any references to SHA512 in that code. There was a reference online regarding an appsettings.json file for identity service in relation to Commerce, but not XP0, and that file doesn't exist that I can see.

4
  • Similar question to sitecore.stackexchange.com/q/17980/1278 which has no answer at time of writing. May 6, 2019 at 4:59
  • From what I can see, it should be possible to clone and modify github.com/sma73648/identityserver-contrib-membership/blob/… and just overwrite the IdentityServer4.Contrib.Membership.dll. But to me this isn't a good solution as it's way out of support. I'd recommend opening a Sitecore support ticket and request a patch for this. May 6, 2019 at 5:14
  • I opened a ticket, thanks! May 6, 2019 at 10:23
  • This issue has been registered as a bug with public reference number 302092. There is a hotfix available for Sitecore Identity Server 2.0.0 which supports SHA512. Contact Sitecore Support for the hotfix.
    – andyp
    Jun 20, 2019 at 8:04

0

Browse other questions tagged or ask your own question.