2

I am trying to implement federated login for my website in Sitecore 9.1. We are using Open Id connect with an implicit flow so that we upon authentication receive an identity-token.

I've written a config file and overridden the IdentityProcessor, and it seems that everything is working. When I hit the login link I get redirected to the external login page and when I am authenticated there I get redirected back to my website. However, when I check to see if I have the roles that I have specified in the transformation-node in my config file, they're not assigned to my user?

The token I'm receiving is:

{"typ":"JWT","alg":"RS256"}{"sub":"anonymousUser","aud":"03ffdc3a-9328-4912-8c73-a40ddb09cd85","nbf":1563539052,"role":"write","idp":"demo","iss":"https:\/\/xxxx.xxxx.xxx.xxxxxxxxxxxx.xx","name":"anonymousUser","company":"[\"companyA\",\"companyB\"]","exp":1563539412,"iat":1563539111,"nonce":"636991359115494880.ODU1ZDQ2ZDEtNTI0Ni00YmJmLThhMmQtYTc5MjFiZjY1YTY5N2M0ODBjZGQtMjdkMS00NGU2LWIwNDktYWNkYzFmYWNiZmYz","jti":"0b9e6dca-29c1-4a3b-8ea3-95a1f23b5d43"}

and my config is:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/">
  <sitecore role:require="Standalone or ContentDelivery or ContentManagement">
      <services>
          <register serviceType="Sitecore.Abstractions.BaseAuthenticationManager, Sitecore.Kernel"
                    implementationType="Sitecore.Owin.Authentication.Security.AuthenticationManager, Sitecore.Owin.Authentication"
                    lifetime="Singleton" />
          <register serviceType="Sitecore.Abstractions.BaseTicketManager, Sitecore.Kernel"
                    implementationType="Sitecore.Owin.Authentication.Security.TicketManager, Sitecore.Owin.Authentication"
                    lifetime="Singleton" />
          <register serviceType="Sitecore.Abstractions.BasePreviewManager, Sitecore.Kernel"
                    implementationType="Sitecore.Owin.Authentication.Publishing.PreviewManager, Sitecore.Owin.Authentication"
                    lifetime="Singleton" />
      </services>
      <pipelines>
          <owin.identityProviders>
              <processor type="SC.Foundation.Login.Infrastructure.Pipelines.XxIdentityProvider, SC.Foundation.Login" resolve="true"/>
          </owin.identityProviders>
      </pipelines>
      <federatedAuthentication>
          <identityProviders hint="list:AddIdentityProvider">
              <identityProvider id="demo" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication">
                  <param desc="name">$(id)</param>
                  <param desc="domainManager" type="Sitecore.Abstractions.BaseDomainManager" resolve="true" />
                  <transformations hint="list:AddTransformation">
                      <transformation name="set idp claim" ref="federatedAuthentication/sharedTransformations/setIdpClaim" />
                      <transformation name="readRole" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
                          <sources hint="raw:AddSource">
                              <claim name="role" value="read" />
                          </sources>
                          <targets hint="raw:AddTarget">
                              <claim name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" value="extranet\read" />
                          </targets>
                          <keepSource>true</keepSource>
                      </transformation>
                      <transformation name="writeRole" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
                          <sources hint="raw:AddSource">
                              <claim name="role" value="write" />
                          </sources>
                          <targets hint="raw:AddTarget">
                              <claim name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" value="extranet\write" />
                          </targets>
                          <keepSource>true</keepSource>
                      </transformation>
                  </transformations>
              </identityProvider>
          </identityProviders>
          <identityProvidersPerSites hint="list:AddIdentityProvidersPerSites">
              <!--The list of providers assigned to all sites-->
              <mapEntry name="xUsers" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication">
                  <sites hint="list">
                      <site>website</site>
                  </sites>
                  <identityProviders hint="list:AddIdentityProvider">
                      <identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='demo']" />
                  </identityProviders>
                  <externalUserBuilder type="Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, Sitecore.Owin.Authentication">
                      <param desc="isPersistentUser">true</param>
                  </externalUserBuilder>
              </mapEntry>

          </identityProvidersPerSites>
          <sharedTransformations hint="list:AddSharedClaimsTransformation">
              <!--Adds idp claim to identity. Every provider should reference to it-->
              <setIdpClaim name="setIdpClaim" type="Sitecore.Owin.Authentication.Services.SetIdpClaimTransform, Sitecore.Owin.Authentication"/>
              <nameClaimTransformation name="nameClaimTransformation" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
                  <sources hint="raw:AddSource">
                      <claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier"/>
                  </sources>
                  <targets hint="raw:AddTarget">
                      <claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"/>
                  </targets>
                  <keepSource>true</keepSource>
              </nameClaimTransformation>


          </sharedTransformations>
      </federatedAuthentication>
  </sitecore>
</configuration>

So specifically I want my user to receive the extranet/write role that I created

enter image description here

My processor looks like:

        using Sitecore.Abstractions;
        using Sitecore.Owin.Authentication.Pipelines.IdentityProviders;
        using Sitecore.Owin.Authentication.Configuration;
        using SC.Foundation.Login.Models;
        using Microsoft.IdentityModel.Tokens;
        using Microsoft.IdentityModel.Logging;
        using Microsoft.Owin.Infrastructure;
        using Microsoft.AspNet.Identity;
        using Microsoft.Owin.Security.Cookies;
        using Microsoft.IdentityModel.Protocols.OpenIdConnect;
        using Microsoft.Owin.Security.OpenIdConnect;

        namespace SC.Foundation.Login.Infrastructure.Pipelines
        {
            using Owin;

            public class XxIdentityProvider : IdentityProvidersProcessor
            {
                private ClientData clientData;

                private DecryptionKey decryptionKey;

                protected override string IdentityProviderName => "demo";

                public XxIdentityProvider(FederatedAuthenticationConfiguration federatedAuthenticationConfiguration, ICookieManager cookieManager, BaseSettings settings) : base(federatedAuthenticationConfiguration, cookieManager, settings)
                {
                    decryptionKey = new DecryptionKey
                    {
                        FilePath = Sitecore.Configuration.Settings.GetSetting("DecryptionKeyPath"),
                        Password = Sitecore.Configuration.Settings.GetSetting("DecryptionKeyPassword")
                    };

                    clientData = new ClientData
                    {
                        ClientId = Sitecore.Configuration.Settings.GetSetting("ClientId"),
                        AuthorizationEndpoint = Sitecore.Configuration.Settings.GetSetting("AuthorizationEndpoint"),
                        ValidIssuer = Sitecore.Configuration.Settings.GetSetting("ValidIssuer"),
                        SigningKeyPath = Sitecore.Configuration.Settings.GetSetting("SigningKeyPath"),
                        DecryptionKey = decryptionKey
                    };
                }

                protected override void ProcessCore(IdentityProvidersArgs args)
                {
                    var identityProvider = this.GetIdentityProvider();

                    IdentityModelEventSource.ShowPII = true;

                    args.App.UseCookieAuthentication(new CookieAuthenticationOptions
                    {
                        AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie
                    });

                    var tokenValidationParameters = (new TokenValidationParameters
                    {
                        TokenDecryptionKey = clientData.DecryptingCertificate(),
                        IssuerSigningKey = clientData.SigningCertificate(),
                        ValidIssuer = clientData.ValidIssuer,
                        ValidAudience = clientData.ClientId
                    });

                    var openIdConnectConfiguration = (new OpenIdConnectConfiguration
                    {
                        AuthorizationEndpoint = clientData.AuthorizationEndpoint
                    });

                    args.App.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
                    {
                        ClientId = clientData.ClientId,
                        AuthenticationType = this.GetAuthenticationType(),
                        Configuration = new OpenIdConnectConfiguration
                        {
                            AuthorizationEndpoint = clientData.AuthorizationEndpoint
                        },
                        Scope = OpenIdConnectScope.OpenId,
                        Notifications = new OpenIdConnectAuthenticationNotifications
                        {
                           SecurityTokenValidated = notification =>
                           {


                               notification.AuthenticationTicket.Identity.ApplyClaimsTransformations(new TransformationContext(this.FederatedAuthenticationConfiguration, identityProvider));
                               return Task.CompletedTask;
                           },

                       },
                       RedirectUri = "http://virk.xm1.dk/",
                       ResponseType = OpenIdConnectResponseType.IdToken,
                       TokenValidationParameters = tokenValidationParameters
                    });
                }
            }
        }

When I try to see if my user has the role extranet/write after login

Role role = Role.FromName(@"extranet\write");
var isInRole = Sitecore.Context.User.IsInRole(role);

I get false.

However, I can see that a user is created in my User manager enter image description here but when I try to write out the users username

var username = Sitecore.Security.Accounts.User.Current.Name;

I don't get the gibberish string dSEvLyc6hQ but just extranet\Anonymous.

This is the first time I'm trying to implement federated login in Sitecore, so maybe I'm missing something basic or have misunderstood something? Can I only assign the roles through a custom Transformation instead of Sitecore.Owin.Authentication.Services.DefaultTransformation? Or are these roles only available in CM and not CD?

Furthermore, another problem I'm encountering is that I can't use my own custom domain for my users. If I use the following eai domain that I've created in Sitecore enter image description here in my config file

<domain>eai</domain>

I get the following error page when trying to hit my website enter image description here

Is this not possible or what am I doing wrong?

Hope you all can bear with me.

  • can you please make sure that you have added domain node under identityProvider section in the Owin configuration - <domain>eai</domain> – Mahendra Shekhawat Jul 30 '19 at 12:31
  • @MahendraShekhawat It is added. I didn't include in the example above because the first question pertains to the transformations. I added a code segment to my original post to clarify that the domain node with eai is added when i get the yellow error page – suma1729 Jul 30 '19 at 13:23
  • Hey @suma1729 - was this ever resolved? – Ben Sewards Jul 28 at 23:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.