I've configured a custom Identity Provider based on this info:
Unsuccessful login with external provider
It works and I can login. This is how it looks in my merged config.
identityProvidersPerSites
<identityProvidersPerSites hint="list:AddIdentityProvidersPerSites" patch:source="Foundation.Identity.config">
<!-- Defines a list of providers assigned to all sites. -->
<mapEntry name="all sites" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true">
<!--
The list of site names for which the specified identity providers will work.
Note: the fedauth.siteNameExpander pipeline processes each site name, which gives the ability to use expressions like
"regexp:modules_.*" or "database:web" or "domain:extranet"
-->
<sites hint="list">
<site>regexp:.*</site>
</sites>
<identityProviders hint="list:AddIdentityProvider"/>
<externalUserBuilder type="Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, Sitecore.Owin.Authentication" resolve="true">
<IsPersistentUser>true</IsPersistentUser>
</externalUserBuilder>
</mapEntry>
<mapEntry name="sites with the web database" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true">
<sites hint="list">
<site>database:web</site>
</sites>
<identityProviders hint="list:AddIdentityProvider"/>
</mapEntry>
<mapEntry name="sites with the core and unspecified database" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true" patch:source="Sitecore.Owin.Authentication.IdentityServer.config">
<sites hint="list">
<site>database:core</site>
<site>database:</site>
</sites>
<identityProviders hint="list:AddIdentityProvider" patch:source="Sitecore.Owin.Authentication.IdentityServer.config">
<identityProvider id="SitecoreIdentityServer" ref="federatedAuthentication/identityProviders/identityProvider[@id='SitecoreIdentityServer']" patch:source="Sitecore.Owin.Authentication.IdentityServer.config"/>
</identityProviders>
</mapEntry>
<mapEntry name="sites with extranet domain" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true" patch:source="Foundation.Identity.config">
<sites hint="list" patch:source="Foundation.Identity.config">
<site>mywebsite</site>
</sites>
<identityProviders hint="list:AddIdentityProvider" patch:source="Foundation.Identity.config">
<identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='ExternalIdentityProvider']"/>
</identityProviders>
<externalUserBuilder type="Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, Sitecore.Owin.Authentication" resolve="true" patch:source="Foundation.Identity.config">
<IsPersistentUser>true</IsPersistentUser>
</externalUserBuilder>
</mapEntry>
<mapEntry name="admin site" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true">
<sites hint="list">
<site>admin</site>
</sites>
<identityProviders hint="list:AddIdentityProvider"/>
</mapEntry>
</identityProvidersPerSites>
identityProviders
<identityProviders hint="list:AddIdentityProvider">
<identityProvider id="SitecoreIdentityServer" type="Sitecore.Owin.Authentication.IdentityServer.IdentityServerProvider, Sitecore.Owin.Authentication.IdentityServer" resolve="true" patch:source="Sitecore.Owin.Authentication.IdentityServer.config">
<caption>Go to login</caption>
<domain>sitecore</domain>
<enabled>true</enabled>
<triggerExternalSignOut>true</triggerExternalSignOut>
<transformations hint="list:AddTransformation">
<transformation name="apply additional claims" type="Sitecore.Owin.Authentication.IdentityServer.Transformations.ApplyAdditionalClaims, Sitecore.Owin.Authentication.IdentityServer" resolve="true"/>
<transformation name="name to long name" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="name"/>
</sources>
<targets hint="raw:AddTarget">
<claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"/>
</targets>
<keepSource>true</keepSource>
</transformation>
<transformation name="role to long role" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="role"/>
</sources>
<targets hint="raw:AddTarget">
<claim name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role"/>
</targets>
<keepSource>false</keepSource>
</transformation>
<transformation name="set ShadowUser" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="http://schemas.microsoft.com/identity/claims/identityprovider" value="local"/>
</sources>
<targets hint="raw:AddTarget">
<claim name="http://www.sitecore.net/identity/claims/shadowuser" value="true"/>
</targets>
<keepSource>true</keepSource>
</transformation>
<transformation name="use exp claim for authentication cookie expiration" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="exp"/>
</sources>
<targets hint="raw:AddTarget">
<claim name="http://www.sitecore.net/identity/claims/cookieExp"/>
</targets>
<keepSource>true</keepSource>
</transformation>
<transformation name="remove local role claims" type="Sitecore.Owin.Authentication.IdentityServer.Transformations.RemoveLocalRoles, Sitecore.Owin.Authentication.IdentityServer"/>
<transformation name="adjust NameIdentifier claim" type="Sitecore.Owin.Authentication.IdentityServer.Transformations.AdjustNameIdentifierClaim, Sitecore.Owin.Authentication.IdentityServer" resolve="true"/>
</transformations>
</identityProvider>
<identityProvider id="ExternalIdentityProvider" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication" patch:source="Foundation.Identity.config">
<param desc="name">$(id)</param>
<param type="Sitecore.Abstractions.BaseDomainManager" desc="domainManager" resolve="true"/>
<caption>Log in with OpenId Connect</caption>
<icon>
/sitecore/shell/themes/standard/Images/24x24/bas.png
</icon>
<domain>extranet</domain>
<transformations hint="list:AddTransformation">
<transformation name="Idp Claim" type="Sitecore.Owin.Authentication.Services.SetIdpClaimTransform, Sitecore.Owin.Authentication"/>
</transformations>
</identityProvider>
</identityProviders>
The problem is that I can't login on both these Identity Providers at the same time. If I login into the backoffice with the SitecoreIdentityServer provider the ".AspNet.Cookies" cookie is set. When I login in the ExternalIdentityProvider the same ".AspNet.Cookies" cookie is set.
I want to be able to login in Sitecore with SitecoreIdentityServer and the frontend with ExternalIdentityProvider at the same time. So somehow I need to make sure they each have a unique cookie and not ".AspNet.Cookies". I found these docs: https://doc.sitecore.com/developers/91/sitecore-experience-manager/en/using-federated-authentication-with-sitecore.html#idm45839230508336. It says the cookie is build like this: ".Asp." + AuthenticationType + AuthenticationSource. Does anyone know where in my Identity Provider I need to set this? I tried to create my own CookieAuthentication and use SetDefaultSignInAsAuthenticationType, but it keeps using the same cookie.
