Sitecore redirects for login page using hostname

Question

We have a sitecore instance (xp0 for now) with an identity server. They are deployed to azure and belong to a private vnet.

Access to nodes is done through the application gateway. But because of those internal sitecore redirects I cant find the way to fix it:

For example:

1. app gw url is "https://my-sitecore.test.com", identity server route is "https://my-sitecore.test.com/sitecore-identity".
2. I navigate to "https://my-sitecore.test.com/sitecore"
3. It redirects to "https://my-sitecore.azurewebsites.net/sitecore/client/Applications/Launchpad?sc_lang=en" and then to "/externallogin"
4. Then it redirects to "https://my-sitecore-identity.azurewebsites.net/connect/authorize?client_id=...."

But it exposes all of those urls, and the plan is to keep them internal, only accessing the app from application gateway.

Is there a way to achieve it, or only option is not use the application gateway at all?

Answer 1

Fond a way to make it work!

First of all - couple of assumptions:

1. For simplicity I am using xp0 topology;
2. You are using azure;
3. In azure you have a DNS zone for your domain (test.com in my example)

Now, the solution is actually quite simple!

In the DNS Zone for test.com you create 4 records:

1. A-record for my-sitecore pointing to the public ip of the application gateway
2. A-record for my-sitecore-identity pointing to the public ip of the application gateway
3. TXT-record for awverify.my-sitecore with a value of my-sitecore.azurewebsites.net
4. TXT-record for awverify.my-sitecore-identity with a value of my-sitecore-identity.azurewebsites.net

Next, to your applications you assign custom domains (my-sitecore.text.com for my-sitecore.azurewebsites.net and my-sitecore-identity.test.com for my-sitecore-identity.azurewebsites.net)

Getting to AppGW setup:

• 2 listeners that listen to specific hosts (my-sitecore.test.com and my-sitecore-identity.test.com)
• 2 backends for our apps (my-sitecore.azurewebsites.net and my-sitecore-identity.azurewebsites.net)
• 2 http settings. Important bit here is to set "Override host name" property to be exact the same as listener host name
• 2 probes (usual stuff) that will try to hit "/".

Cool! Now the final step to make is to complete the identity setup. Enable Sitecore.Owin.Authentication.IdentityServer.config config and set identityServerAuthority to https://y-sitecore-identity.test.com. Plus all the other setup of identity server with secrets etc.

Phew! But after that - all the redirects worked fine for me! Hope this will help someone or maybe I`ll forget how it was working and will stumble on this answer sometime later :)