3

I have an XP Single instance deployed to Azure PAAS that has been configured to use Azure AD by following this blog post:

https://sitecore.derekc.net/setting-up-azure-active-directory-integration-with-sitecore-identity-server-sitecore-9-1/

Admin users are now able to login with Azure AD and get to the Sitecore shell. However, navigating to any URL that begins with /sitecore/admin causes the user to end up in a never-ending redirect loop.

When I navigate to /sitecore/admin/showconfig.aspx, I get an access denied error, then get redirected to the identity server, into which I have already logged in. The identity server then redirects me back to the original URL, which throws an access denied error again and redirects me back to the identity server. This will go on forever if I don't stop it.

Does anyone know what I might be missing?

Improve this question
3
  • make sure, you map the claim that tells Sitecore this user is an Administrator in the "configuration>sitecore>federatedAuthentication>propertyInitializer>maps" node?
    – Mahendra Shekhawat
    Sep 18, 2019 at 17:35
  • The Administrator mapping seems to be working correctly, because I see all of the tools when I log into /sitecore/shell
    – Jason Reineri
    Sep 19, 2019 at 15:12
  • so the administrator is not a role in Sitecore its a properly(checkbox), usually, this kind of error comes when the user is a member of admin group but not an administrator. try by adding some custom code to check the Isadministrator and debug it to make sure the user is an administrator.
    – Mahendra Shekhawat
    Sep 19, 2019 at 15:21

1 Answer 1

Reset to default
2

I recently ran into something similar after configuring federated authentication in Sitecore 9.1.1 using Azure AD. Verify that the /sitecore/admin/ path is added to the <siteNeutralPaths /> element in the ValidateSiteNeutralPaths pipeline processor config, otherwise the user's identity won't be properly validated when accessing resources under that path:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" 
    xmlns:role="http://www.sitecore.net/xmlconfig/role/" 
    xmlns:security="http://www.sitecore.net/xmlconfig/security/">
    <sitecore role:require="Standalone or ContentManagement" security:require="Sitecore">
        <pipelines>
            <owin.cookieAuthentication.validateIdentity>
                <processor type="Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.ValidateIdentity.ValidateSiteNeutralPaths, Sitecore.Owin.Authentication">
                    <siteNeutralPaths hint="list">
                        <path>/sitecore/admin/</path>
                    </siteNeutralPaths>
                </processor>
            </owin.cookieAuthentication.validateIdentity>
        </pipelines>
    </sitecore>
</configuration>
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.