0

I am trying to set up Sitecore 9.1.1 Identity Server to act as a Federation Gateway with Azure AD (described here - https://doc.sitecore.com/developers/91/sitecore-experience-management/en/use-the-sitecore-identity-server-as-a-federation-gateway.html). What isn't clear to me is how to register the Sitecore site in Azure AD. I am assuming that in Azure AD you have to configure a Redirect URI or some sort of Reply URL to tell Azure AD where to go after successful authentication. The Sitecore documentation doesn't really specify.

In the Sitecore documentation it links you to this for configuring Azure AD (https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-openid-connect-code). In that documentation it says "Provide the Redirect URI. For Web Applications, this is the base URL of your app where users can sign in." That leads me to believe that the Redirect URI should be https://[SI Server Host Name]/account/login since that is the page I go to when I want to log in. However the Sitecore documentation also makes mention of this URI - https://[SI Server Host Name]/signin-oidc. I have no idea at all what that /signin-oidc thing is. When I try to go to that on my Identity Server I get a 404 error.

Does anyone know exactly what I should put in ADFS for the Redirect URI? Also the Sitecore documentation mentions the ReplyURLs setting in the Application Manifest. Although it isn't clear what they mean by that I am guessing they mean the Application Manifest in the Azure AD setup.

  • Did you take a look at this sitecore.derekc.net/… I believe the /signin-oidc is where the Open ID Connect ID token gets posted back at. – Jeroen Jun 13 at 16:05
  • Yes. I saw that. So in Azure we put in this URL as the Redirect URL - https://[SI Server Host Name]/signin-oidc. And it worked. It redirected to that URL. However we get a 404 error on our Identity Server when we get redirected to that URL after Azure authentication. – Corey Burnett Jun 13 at 16:08
  • Verify that redirect url is the url of your identityserver. Not your Sitecore cm instance. – Thomas Stern Jun 14 at 11:58
0

I figured out the problem I was having. It turns out that the steps laid out in this post are exactly correct (https://sitecore.derekc.net/setting-up-azure-active-directory-integration-with-sitecore-identity-server-sitecore-9-1/). What was happening for some reason is that after authentication on the Azure AD instance, Azure AD was sending a GET request to https://[SI Server Host Name]/signin-oidc. My guess is that the controller on the Identity Server is only set up to accept a POST, not a GET. So it was returning a 404 since no MVC route matched a GET request. I can't quite figure out why the Identity Server was receiving a GET request. This was all happening on an on-prem 9.1.1 instance that lives on the client's network. I was able to set up a completely separate 9.1.1 instance in Azure and it worked great authenticating against the exact same Azure AD instance. So that tells me there is something wrong with the on-prem 9.1.1 instance or maybe the client's network that was causing the POST form Azure AD to somehow become just a GET - which then caused the 404 error.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.