Item permissions to trigger federated identity

Question

We have configured a new identity provider for Sitecore 9.1 using the documented federatedAuthentication configuration. The identity provider uses OpenID Connect OWIN middleware to authenticate and authorize extranet users visiting pages on the website.

Using Sitecore item permissions, I am denying access to items for which visitors need to be authenticated to view.

When visiting a page requiring authorization, Sitecore is redirecting my to:

/sitecore/service/noaccess.aspx?item=%2fauthorize&user=extranet%5cAnonymous&site=website with a HTTP response code of 403.

How can I get the identity provider OWIN middleware to initiate the authentication flow when it sees such a response from Sitecore?

Answer 1

This requires a loginPage attribute on the site node, as indicated by the comments in Sitecore.Owin.Authentication.config:

<!-- LOGIN PATH variable
     Specifies the login path prefix for federated authentication. It should be used in the "site" nodes in the "loginPage" attribute.
     The full login path must have this structure:
     $(loginPath)site_name/identity_provider
     or
     $(loginPath)site_name/identity_provider/inner_identity_provider,
     The site_name must have the "name" attribute value of the "site" node where the login path is set.
     The "identity_provider" must have the "id" attribute value of the configured identity provider that you want to use.
     The "inner_identity_provider" must be equal to the name or AuthenticationScheme of the underlying identity provider in the "identity_provider".

     Note: The "inner_identity_provider" value is sent to the "identity_provider" as an acr_value - idp:inner_identity_provider. Thus, identity_provider have to support acr_value.

     Examples:
         <sites>
             <site name="shell" set:loginPage="$(loginPath)shell/IdentityServer"/>
             <site name="admin" set:loginPage="$(loginPath)admin/IdentityServer/IdS4-AzureAd"/>
         </sites> -->

<sc.variable name="loginPath" value="$(identityProcessingPathPrefix)login/" />