2

I've configured a custom Identity Provider based on this info:

http://blog.baslijten.com/enable-federated-authentication-and-configure-auth0-as-an-identity-provider-in-sitecore-9-0/

Unsuccessful login with external provider

It works and I can login. This is how it looks in my merged config.

identityProvidersPerSites

<identityProvidersPerSites hint="list:AddIdentityProvidersPerSites" patch:source="Foundation.Identity.config">
<!--  Defines a list of providers assigned to all sites.  -->
<mapEntry name="all sites" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true">
<!--
 The list of site names for which the specified identity providers will work.
               Note: the fedauth.siteNameExpander pipeline processes each site name, which gives the ability to use expressions like
               "regexp:modules_.*" or "database:web" or "domain:extranet" 
-->
<sites hint="list">
<site>regexp:.*</site>
</sites>
<identityProviders hint="list:AddIdentityProvider"/>
<externalUserBuilder type="Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, Sitecore.Owin.Authentication" resolve="true">
<IsPersistentUser>true</IsPersistentUser>
</externalUserBuilder>
</mapEntry>
<mapEntry name="sites with the web database" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true">
<sites hint="list">
<site>database:web</site>
</sites>
<identityProviders hint="list:AddIdentityProvider"/>
</mapEntry>
<mapEntry name="sites with the core and unspecified database" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true" patch:source="Sitecore.Owin.Authentication.IdentityServer.config">
<sites hint="list">
<site>database:core</site>
<site>database:</site>
</sites>
<identityProviders hint="list:AddIdentityProvider" patch:source="Sitecore.Owin.Authentication.IdentityServer.config">
<identityProvider id="SitecoreIdentityServer" ref="federatedAuthentication/identityProviders/identityProvider[@id='SitecoreIdentityServer']" patch:source="Sitecore.Owin.Authentication.IdentityServer.config"/>
</identityProviders>
</mapEntry>
<mapEntry name="sites with extranet domain" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true" patch:source="Foundation.Identity.config">
<sites hint="list" patch:source="Foundation.Identity.config">
<site>mywebsite</site>
</sites>
<identityProviders hint="list:AddIdentityProvider" patch:source="Foundation.Identity.config">
<identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='ExternalIdentityProvider']"/>
</identityProviders>
<externalUserBuilder type="Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, Sitecore.Owin.Authentication" resolve="true" patch:source="Foundation.Identity.config">
<IsPersistentUser>true</IsPersistentUser>
</externalUserBuilder>
</mapEntry>
<mapEntry name="admin site" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true">
<sites hint="list">
<site>admin</site>
</sites>
<identityProviders hint="list:AddIdentityProvider"/>
</mapEntry>
</identityProvidersPerSites>

identityProviders

<identityProviders hint="list:AddIdentityProvider">
<identityProvider id="SitecoreIdentityServer" type="Sitecore.Owin.Authentication.IdentityServer.IdentityServerProvider, Sitecore.Owin.Authentication.IdentityServer" resolve="true" patch:source="Sitecore.Owin.Authentication.IdentityServer.config">
<caption>Go to login</caption>
<domain>sitecore</domain>
<enabled>true</enabled>
<triggerExternalSignOut>true</triggerExternalSignOut>
<transformations hint="list:AddTransformation">
<transformation name="apply additional claims" type="Sitecore.Owin.Authentication.IdentityServer.Transformations.ApplyAdditionalClaims, Sitecore.Owin.Authentication.IdentityServer" resolve="true"/>
<transformation name="name to long name" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="name"/>
</sources>
<targets hint="raw:AddTarget">
<claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"/>
</targets>
<keepSource>true</keepSource>
</transformation>
<transformation name="role to long role" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="role"/>
</sources>
<targets hint="raw:AddTarget">
<claim name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role"/>
</targets>
<keepSource>false</keepSource>
</transformation>
<transformation name="set ShadowUser" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="http://schemas.microsoft.com/identity/claims/identityprovider" value="local"/>
</sources>
<targets hint="raw:AddTarget">
<claim name="http://www.sitecore.net/identity/claims/shadowuser" value="true"/>
</targets>
<keepSource>true</keepSource>
</transformation>
<transformation name="use exp claim for authentication cookie expiration" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="exp"/>
</sources>
<targets hint="raw:AddTarget">
<claim name="http://www.sitecore.net/identity/claims/cookieExp"/>
</targets>
<keepSource>true</keepSource>
</transformation>
<transformation name="remove local role claims" type="Sitecore.Owin.Authentication.IdentityServer.Transformations.RemoveLocalRoles, Sitecore.Owin.Authentication.IdentityServer"/>
<transformation name="adjust NameIdentifier claim" type="Sitecore.Owin.Authentication.IdentityServer.Transformations.AdjustNameIdentifierClaim, Sitecore.Owin.Authentication.IdentityServer" resolve="true"/>
</transformations>
</identityProvider>
<identityProvider id="ExternalIdentityProvider" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication" patch:source="Foundation.Identity.config">
<param desc="name">$(id)</param>
<param type="Sitecore.Abstractions.BaseDomainManager" desc="domainManager" resolve="true"/>
<caption>Log in with OpenId Connect</caption>
<icon>
/sitecore/shell/themes/standard/Images/24x24/bas.png
</icon>
<domain>extranet</domain>
<transformations hint="list:AddTransformation">
<transformation name="Idp Claim" type="Sitecore.Owin.Authentication.Services.SetIdpClaimTransform, Sitecore.Owin.Authentication"/>
</transformations>
</identityProvider>
</identityProviders>

The problem is that I can't login on both these Identity Providers at the same time. If I login into the backoffice with the SitecoreIdentityServer provider the ".AspNet.Cookies" cookie is set. When I login in the ExternalIdentityProvider the same ".AspNet.Cookies" cookie is set.

I want to be able to login in Sitecore with SitecoreIdentityServer and the frontend with ExternalIdentityProvider at the same time. So somehow I need to make sure they each have a unique cookie and not ".AspNet.Cookies". I found these docs: https://doc.sitecore.com/developers/91/sitecore-experience-manager/en/using-federated-authentication-with-sitecore.html#idm45839230508336. It says the cookie is build like this: ".Asp." + AuthenticationType + AuthenticationSource. Does anyone know where in my Identity Provider I need to set this? I tried to create my own CookieAuthentication and use SetDefaultSignInAsAuthenticationType, but it keeps using the same cookie.

2

using different domains for front- and backend is the most simple one. Cookies won't be shared between those domains.

  • Hi Bas. As you can see in the identityProviders XML I'm already using the Sitecore domain for SitecoreIdentityServer and the extranet for ExternalIdentityProvider. They still override the same cookie. – Jeroen Breuer Jan 24 at 13:48
  • I think he means a different host name, so your cookies are not shared between sites. That is the most common way of setting this up. Also, I will often use a different browser or open an incognito window. – Richard Seal Jan 24 at 14:03
  • Hi Richard. I want to login into Sitecore and preview the website. Than in preview I want to do another login with the frontend Identity Provider. So I can't use different browsers. – Jeroen Breuer Jan 24 at 14:07
  • oeh, that's a different usecase and I don't think that would be a very feasible approach. Don't think that his is a best practice as the preview mode behaves "differently". what would you like to test out? – Bas Lijten Jan 31 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.