2

Official Sitecore documentation is very minimalistic in many points ;-)

Has someone already implemented an IdentityServer provider to work with ADFS (not Azure AD) and OpenID with Sitecore 9.2?

I have only found https://github.com/istern/Sitecore.IdentityServer.ADFS for 9.1 - but looks like there have been a couple of changes since 9.1?

best regards,
Markus

4

I have actually blogged about how to implement this, though I am using Sitecore 9.3 in my scenario (I believe this should work in 9.2 as well)

You need to do the following:

  1. Create a Sitecore Host Plugin for ADFS using OpenID. The key to this plugin is to specify these options below. I have added a screenshot of my implementation (link to Github on my blog post below too)

        options.SignInScheme          = "idsrv.external";
        options.ResponseType          = "id_token";
        options.CallbackPath          = "/signin-adfs";
    

Adfs-OpenId

  1. Deploy your plugin to your SI instance. Again if you haven't done this before, you will find details on my blog (or from Siteocore Docs). In brief, your plugin should be deployed in the sitecoreruntime sub-folder on your SI wwwroot folder
  2. Configure your ADFS and generate ClientId and ClientSecret You will need this in your configuration for the plugin. Also remember to set the Callback URL in your ADFS to "/signin-adfs"

Hope this works for you. I have blogged about this in details, including related post on creating Sitecore Host plugins.

| improve this answer | |
  • thanks looks really good - im am wondering which effect the options.CallbackPath = "/signin-idsrv" and signout path has - I have it set with options.CallbackPath = "/signin-idsrv"; and without client-secret and looks like this is also working... so is your adfs configuration really configured with openid - or something similar... currently i have the problem that the cookiesize saved from sitecore gets too large - cause of too many groups adfs returns.... – Mkress Apr 2 at 11:19
  • Great that this has worked for you. The key thing is so long as the options.CallbackPath = "/signin-idsrv" matches your ADFS portal configuration, that will be fine. Otherwise you will get an error message. I didn't come across the cookiesize issue, I suppose you can try tweak the settings for that too. – Julius A Apr 2 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.