How can I get SXA login working with my Federated Authentication via IdentityServer?

Question

Background

We're building an internal site where all users are required to be authenticated. I've configured IdentityServer to connect to the organisation's Azure AD and this is working fine. When I log in to my Sitecore Client I can choose "Login with Azure AD" and based on role mappings, I am allowed into the client.

I want our site visitors to also have to go via this login process.

What I've done so far

• I created a blank login page on our site.
• I checked "Require Login" under Site Grouping for our site
• I pointed the "Login Page" under Site Grouping to my blank login page

At first I tried to follow the steps in this article, instructing me to configure a special security controller. But I misread the article, I only need to do that if I do NOT want the default behaviour of being redirected to Sitecore's login page. So the opposite of what I want.

What happens

It does not behave as intended. Or at least as I expected.

If I navigate to my site now, it redirects me to /login just fine. But then it ends up in an endless loop. I'm trying to understand why.

The URL ends up looking like this: http://sc911.sc/Demo/login?ReturnUrl=%2fDemo%2flogin%3fReturnUrl%3d%252fDemo%252flogin%253fReturnUrl%253d%25252fDemo%25252flogin%25253fReturnUrl%25253d%2525252fDemo%2525252flogin%2525253fReturnUrl%2525253d%252525252fDemo%252525252flogin%252525253fReturnUrl%252525253d%25252525252fDemo%25252525252flogin%25252525253fReturnUrl%25252525253d%2525252525252fDemo%2525252525252flogin%2525252525253fReturnUrl%2525252525253d%252525252525252fDemo%252525252525252flogin%252525252525253fReturnUrl%252525252525253d%25252525252525252fDemo%25252525252525252flogin%25252525252525253fReturnUrl%25252525252525253d%2525252525252525252fDemo%2525252525252525252flogin%2525252525252525253fReturnUrl%2525252525252525253d%252525252525252525252fDemo%252525252525252525252flogin%252525252525252525253fReturnUrl%252525252525252525253d%25252525252525252525252fDemo%25252525252525252525252flogin%25252525252525252525253fReturnUrl%25252525252525252525253d%2525252525252525252525252fDemo%2525252525252525252525252flogin%2525252525252525252525253fReturnUrl%2525252525252525252525253d%252525252525252525252525252fDemo%252525252525252525252525252flogin%252525252525252525252525253fReturnUrl%252525252525252525252525253d%25252525252525252525252525252fDemo%25252525252525252525252525252flogin%25252525252525252525252525253fReturnUrl%25252525252525252525252525253d%2525252525252525252525252525252fDemo%2525252525252525252525252525252flogin%2525252525252525252525252525253fReturnUrl%2525252525252525252525252525253d%252525252525252525252525252525252fDemo%252525252525252525252525252525252flogin%252525252525252525252525252525253fReturnUrl%252525252525252525252525252525253d%25252525252525252525252525252525252fDemo%25252525252525252525252525252525252flogin%25252525252525252525252525252525253fReturnUrl%25252525252525252525252525252525253d%2525252525252525252525252525252525252fDemo%2525252525252525252525252525252525252flogin%2525252525252525252525252525252525253fReturnUrl%2525252525252525252525252525252525253d%252525252525252525252525252525252525252fDemo%252525252525252525252525252525252525252flogin%252525252525252525252525252525252525253freturnUrl%252525252525252525252525252525252525253d%25252525252525252525252525252525252525252fDemo

At which point my Chrome gives up and throws this at me.

HTTP Error 404.15 - Not Found The request filtering module is configured to deny a request where the query string is too long.

Is there anything else I need to configure, to get this working?

Am on Sitecore 9.1.1, SXA 1.8.1

Answer 1

So after some back and forth with Sitecore Support, this is the conclusion and the solution.

1. The fact that SXA ends up in the endless loop has been registered as a bug. Bug reference number #349107.

2. The solution is this

You need to add the site registration to SitecoreIdentity, making it a known entity for it to act on. We added the following configuration patch - "demo" is the name of the site we're mapping.

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/" xmlns:security="http://www.sitecore.net/xmlconfig/security/">

    <!-- In reference to Ticket #536646 on Sitecore Support Portal -->
    <sitecore role:require="Standalone or ContentDelivery or ContentManagement">
        <federatedAuthentication type="Sitecore.Owin.Authentication.Configuration.FederatedAuthenticationConfiguration, Sitecore.Owin.Authentication">
            <identityProvidersPerSites hint="list:AddIdentityProvidersPerSites">
                <mapEntry name="demo site" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication">
                    <sites hint="list">
                        <site>demo</site>
                    </sites>
                    <identityProviders hint="list:AddIdentityProvider">
                        <identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='SitecoreIdentityServer']" id="SitecoreIdentityServer" />
                    </identityProviders>
                    <externalUserBuilder type="Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, Sitecore.Owin.Authentication">
                        <IsPersistentUser>true</IsPersistentUser>
                    </externalUserBuilder>
                </mapEntry>
            </identityProvidersPerSites>
        </federatedAuthentication>
    </sitecore>
</configuration>

And then for the SXA mechanics to work, go to the site definition item (e.g. /sitecore/content/redacted/Global/Demo/Settings/Site Grouping/Demo) and find the Other Properties section. Add the following:

• loginPage -> /identity/login/demo/SitecoreIdentityServer (demo is the name of your site)
• requireLogin -> true

Save and publish this item (and the config) and you're good to go.

Answer 2

I just recently ran into this issue myself and spent hours trying to resolve it. I could hardly find any documentation related to an SXA site (i.e. a CD site) using a federate/Sitecore Identity subprovider to login. Randomly I tried removing the site groupings, and instead used a config file to setup the site:

<sitecore>
  <sites>
    <site name="mysite" loginPage="$(loginPath)mysite/SitecoreIdentityServer/mysubprovider" requireLogin="true".... />
  </sites>
  <experienceAccelerator>
    <siteResolving>
      <site name="mysite" resolve="before" />
    </siteResolving>
  </experienceAccelerator>
</sitecore>

This change seemed to actually trigger the identityProvidersPerSites entry I had in my config that matched the AzureAD examples they had commented out in the Sitecore.Owin.Authentication.IdentityServer.config. I am using PING instead of AzureAD so I had to perform some other steps as well. Since PING wasn't configured fully for me I couldn't complete the round trip back to Sitecore to make sure xConnect works, but if you maybe could loop back and comment on this answer to let me know if you get that working, it could help me too.