We have a sitecore instance (xp0 for now) with an identity server. They are deployed to azure and belong to a private vnet.

Access to nodes is done through the application gateway. But because of those internal sitecore redirects I cant find the way to fix it:

For example:

  1. app gw url is "https://my-sitecore.test.com", identity server route is "https://my-sitecore.test.com/sitecore-identity".
  2. I navigate to "https://my-sitecore.test.com/sitecore"
  3. It redirects to "https://my-sitecore.azurewebsites.net/sitecore/client/Applications/Launchpad?sc_lang=en" and then to "/externallogin"
  4. Then it redirects to "https://my-sitecore-identity.azurewebsites.net/connect/authorize?client_id=...."

But it exposes all of those urls, and the plan is to keep them internal, only accessing the app from application gateway.

Is there a way to achieve it, or only option is not use the application gateway at all?

  • Is it overkill to use application gateway for Sitecore CM ? and moreover you mentioned its is a private vnet
    – Abhay Dhar
    Feb 17, 2020 at 9:57
  • I will suggest use azure traffic manager or IP whitelisting to keep everything you want internal Feb 23, 2020 at 4:54
  • Thanks for the suggestion, but for our design we want to use App GW.
    – JleruOHeP
    Feb 24, 2020 at 0:14

1 Answer 1


Fond a way to make it work!

First of all - couple of assumptions:

  1. For simplicity I am using xp0 topology;
  2. You are using azure;
  3. In azure you have a DNS zone for your domain (test.com in my example)

Now, the solution is actually quite simple!

In the DNS Zone for test.com you create 4 records:

  1. A-record for my-sitecore pointing to the public ip of the application gateway
  2. A-record for my-sitecore-identity pointing to the public ip of the application gateway
  3. TXT-record for awverify.my-sitecore with a value of my-sitecore.azurewebsites.net
  4. TXT-record for awverify.my-sitecore-identity with a value of my-sitecore-identity.azurewebsites.net

Next, to your applications you assign custom domains (my-sitecore.text.com for my-sitecore.azurewebsites.net and my-sitecore-identity.test.com for my-sitecore-identity.azurewebsites.net)

Getting to AppGW setup:

  • 2 listeners that listen to specific hosts (my-sitecore.test.com and my-sitecore-identity.test.com)
  • 2 backends for our apps (my-sitecore.azurewebsites.net and my-sitecore-identity.azurewebsites.net)
  • 2 http settings. Important bit here is to set "Override host name" property to be exact the same as listener host name
  • 2 probes (usual stuff) that will try to hit "/".

Cool! Now the final step to make is to complete the identity setup. Enable Sitecore.Owin.Authentication.IdentityServer.config config and set identityServerAuthority to https://y-sitecore-identity.test.com. Plus all the other setup of identity server with secrets etc.

Phew! But after that - all the redirects worked fine for me! Hope this will help someone or maybe I`ll forget how it was working and will stumble on this answer sometime later :)

  • When you say 'set "Override host name" property to be exact the same as listener host name', can I confirm this means: Select 'Override with new host name' to true, and using the 'Override with specific domain name' option? (Not 'Pick host name from back target'?) And then, entering the domains 'my-sitecore.test.com' and 'my-sitecore-identity.test.com' for the respective HTTP Settings items? Jul 19, 2021 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.