3

I followed the steps here https://sitecore.derekc.net/setting-up-azure-active-directory-integration-with-sitecore-identity-server-sitecore-9-1/ to get this set up and it is all great. However, even with a group mapping setup I still get an error that I am not authorized. Digging into the OWIN logs I find this error. 

22780 15:36:01 WARN  An error with Nonce cookie occured.
Exception: Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolInvalidNonceException
Message: IDX21323: RequireNonce is '[PII is hidden]'. OpenIdConnectProtocolValidationContext.Nonce was null, OpenIdConnectProtocol.ValidatedIdToken.Payload.Nonce was not null. The nonce cannot be validated. If you don't need to check the nonce, set OpenIdConnectProtocolValidator.RequireNonce to 'false'. Note if a 'nonce' is found it will be evaluated.
Source: Microsoft.IdentityModel.Protocols.OpenIdConnect

The only mention I can find for this is on the Sitecore community site. However, it is not clear to me at least what the solution is here. It seems this is a none issue with Microsoft OWIN but to solve this and get Azure AD working with Sitecore Identity server requires adding a 3rd party NuGet solution? That does not smell right to me and I figured some of you out there have to have this working yes? So if the OWIN assembly that gets installed with Sitecore 9.1.1 does not work with Azure AD federation what did you all do?

I have removed all our custom pipeline code from the solution.

Update 4/16 Did a little more digging and I think the error I found was old or at least misleading. If I log in as an admin I can see a user was created with the random naming Sitecore does. If I assign a role to that user I can now log in. So it seems the mapping for the security group to role or isAdmin is not working.

Here is what that config looks like 

<AzureADUserToAdminUser type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
            <SourceClaims>
                            <Claim1 type="groups" value="f67f9b7e-1db5-41f1-b761-3ca6b31f8d70" />
            </SourceClaims>
            <NewClaims>
                            <Claim1 type="http://www.sitecore.net/identity/claims/isAdmin" value="true"/>
            </NewClaims>

I have verified the I have verified (many times) the users belongs to the group and the app's manifest has "groupMembershipClaims": "SecurityGroup"

Improve this question
3
  • Please again try clearing out your cookies from browser or use incognito mode
    – Abhay Dhar
    Commented Apr 16, 2020 at 14:16
  • I have tried both, including different browsers but no change.
    – ToddB
    Commented Apr 16, 2020 at 14:20
  • velir.com/blog/2019/07/01/… , I used this in Sitecore 9.1 , worked perfectly for me , maybe you are missing a step on AD setup side
    – Abhay Dhar
    Commented Apr 16, 2020 at 14:29

1 Answer 1

Reset to default
1

It is always stupid little things. I had one node of the transforms misaligned which meant the above config was falling outside the ClaimsTransformations node.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.