Federated Authentication in Multi sites

Question

I am using Sitecore 9.1, I have multi-sites using different hostnames.

can I share user context between sites after successful authentication from one site, instead of authenticating from each site separately?

Answer 1

Depending upon the provider you use, you can easily enter values for the sites (the list of sites where the provider(s) will work), identityProviders (the list of providers), and externalUserBuilder child nodes. This config will be your custom file if you are using some other provider and if you are using this for Owin OOTB, you can override Sitecore.Owin.Authentication.config under app_config/Sitecore/Owin.Authentication

In the mapEntry within the identityProvidersPerSites, you can define multiple sites for which you want to enable the authentication -

<mapEntry name ="all" type="Sitecore.FederatedAuthentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.FederatedAuthentication">
    <sites hint="list">
        <site>shell</site>
        <site>admin</site>
        <site>website</site>
        <site>xyz</site>
    </sites>
    <identityProviders hint="list:AddIdentityProvider">mapEntry
        <identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='AzureAd']" />
        <identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='IdentityServer']" />
    </identityProviders>
    <externalUserBuilder type="Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, Sitecore.Owin.Authentication">
         <param desc="isPersistentUser">true</param>
    </externalUserBuilder>
</mapEntry>

With this configuration, a virtual user would be created in the Sitecore instance for the authenticated user but this user might not have permission to access Sitecore client application. you need to provide proper rights to access Sitecore client. For more read the configure an identity provider section here - https://doc.sitecore.com/developers/90/sitecore-experience-management/en/configure-federated-authentication.html