Sitecore Context User issue with Preview mode via Sitecore Identity Server

Question

We have an issue with Sitecore 9.1 context user on Preview mode.

Sitecore.Context.User is showing as "extranet\Anonymous" in preview mode when Sitecore CM is authenticating via Identity Server. Whereas in experience editor mode, it's showing as "sitecore\admin"

When we disable Identity server for Sitecore CM, in preview mode, Sitecore.Context.User is showing properly as "sitecore\admin".

We have set Preview.AsAnonymous setting as "False".

Expectation: Sitecore Preview should show the same user account who has logged-in instead of extranet\Anonymous. This behavior is causing issue to render page in preview mode which is protected for Anonymous users.

Note: In Sitecore 8.2, similar settings of preview and similar Sitecore item security works well without issue.

Does anyone know why Sitecore user is not authenticated in preview mode when going through identity server?

Edit: When we turn off the identity server for Sitecore CM, it works as expected. In preview mode, the appropriate user show instead of extranet\Anonymous

Answer 1

I had a similar issue and the following page from the documentation pointed me in the right direction: https://doc.sitecore.com/developers/93/sitecore-experience-manager/en/understanding-sitecore-authentication-behavior-changes.html

From that page:

By default, Sitecore configures the SI server provider to handle authentication for the Sitecore Client sites, for example shell and admin, only. This means if you authenticate in shell through the SI server, website does not accept that user and you are anonymous in the website.

To solve the issue you have to modify sitecore/federatedAuthentication/identityProvidersPerSites to make sure you are also authenticated in the website.

Answer 2

So when we try to preview a page it resolved with the 'website' context but executed within the 'shell' context. If an external identity provider is configured to only be used with the shell site, We must be able to use a user from that provider to make the authorized request. You need to use ValidateSiteNeutralPaths processor in the owin.cookieAuthentication.validateIdentity pipeline to add the siteNeutralPaths for your preview pages. Since we don't have any fix URL pattern like Sitecore API URL for preview page so I guess you need to add "/" in the list in a patch config-

<configuration>
  <sitecore>
    <pipelines>
      <owin.cookieAuthentication.validateIdentity>
        <processor type="Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.ValidateIdentity.ValidateSiteNeutralPaths, Sitecore.Owin.Authentication">
          <siteNeutralPaths hint="list">
            <!-- For preview Mode -->
            <path>/</path>
          </siteNeutralPaths>
        </processor>
      </owin.cookieAuthentication.validateIdentity>
    </pipelines>
  </sitecore>
</configuration>

source can find in Sitecore.Owin.Authentication.config. I have not use the same for preview mode but for custom path, could you please try this?