3

I'm trying to setup Horizon 10.0.1 with Sitecore 10.0.1 on Azure with custom domain (no Content Hub). I followed all the steps from the Azure PaaS Installation guide.

I use the following host names:

test-id.MYHOSTNAME.eu
test-cm.MYHOSTNAME.eu
test-horizon.MYHOSTNAME.eu

I have valid certificate for *.MYHOSTNAME.eu.

In Sitecore Identity in Config/production/Sitecore.IdentityServer.AuthoringHost.xml file I have

<HorizonHttpsCorsOrigin>https://test-horizon.MYHOSTNAME.eu</HorizonHttpsCorsOrigin>

On CM in /App_Config/Modules/Horizon/Sitecore.Horizon.Integration.config I have:

<setting name="Horizon.ClientHost" value="https://test-horizon.MYHOSTNAME.eu" />

and I have

<setting name="Sitecore.Services.SecurityPolicy" value="Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy, Sitecore.Services.Infrastructure" patch:source="Sitecore.Horizon.Integration.SSC.config"/>

In horizon in /sitecore/Sitecore.Horizon.Authoring.Plugin/Config/Host.xml I have:

<Settings>
<FederatedUI>
    <HostBaseUrl>https://test-horizon.MYHOSTNAME.eu</HostBaseUrl>
</FederatedUI>
<ApiGateway>
    <SitecoreHost>https://test-cm.MYHOSTNAME.eu</SitecoreHost>
    <InternalSitecoreHost></InternalSitecoreHost>
</ApiGateway>
</Settings>

In horizon in /sitecore/Sitecore.Horizon.Authoring.Plugin/Config/OpenIdConnect.xml:

<Settings>
  <Sitecore>
    <Authentication>
      <OpenIdConnectOptions>
        <RequireHttpsMetadata>false</RequireHttpsMetadata>
        <ClientId>Sitecore</ClientId>
        <Authority>https://test-identity.MYHOSTNAME.eu/</Authority>
        <LockTimeoutSeconds>300</LockTimeoutSeconds>
        <ClientSecret></ClientSecret>
      </OpenIdConnectOptions>
      <BearerAuthenticationOptions>
        <Authority>https://test-identity.MYHOSTNAME.eu/</Authority>
      </BearerAuthenticationOptions>
    </Authentication>
  </Sitecore>
</Settings>

in /sitecore/Sitecore.Horizon.ContentHub.Dam.Plugin/Config/Plugin.xml:

<Settings>
  <ContentHubDam>
    <PlatformUrl>https://test-cm.MYHOSTNAME.eu</PlatformUrl>
  </ContentHubDam>
</Settings>

in /sitecore/Sitecore.Zenith/Config/Sitecore.Zenith.Proxy.xml:

<Settings>
  <Proxy>
    <DataServiceEndpoint>https://test-cm.MYHOSTNAME.eu</DataServiceEndpoint>
  </Proxy>
  <Security>
    <EnableAuthorization>true</EnableAuthorization>
  </Security>
</Settings>

When I open horizon url I'm redirected to identity server. I login as Admin, and I'm redirected back to horizon url /composer/pages/editor but the screen keeps refreshing and there is an error saying

The page did not load properly. Try refreshing the page. If the error reoccurs, contact your system administrator.

horizon sitecore - The page did not load properly

With developer tools I can see that there is a call to https://test-horizon.MYHOSTNAME.eu/horizon/api and the response is

{
    "data": {
        "configuration": {
            "primaryPlatformUrl": "https://test-cm.MYHOSTNAME.eu",
            "additionalPlatformUrls": [],
            "hostVerificationToken": "",
            "contentRootItemId": "00000000-0000-0000-0000-000000000000",
            "__typename": "Configuration"
        }
    },
    "errors": [{
        "message": "{\"Message\":\"Authorization has been denied for this request.\"}",
        "extensions": {
            "code": "NOT_AUTHORIZED"
        }
    }]
}

In Application Insights I can see entries from CM server saying for all /sitecore/api/ssc/horizon/* request returning 401 response, e.g. /sitecore/api/ssc/horizon/configuration/?sc_horizon=api or /sitecore/api/ssc/horizon/sites/-/getsites?sc_horizon=api&IncludeSystemSites=False

enter image description here

But when I open it via url directly in the browser https://test-cm.MYHOSTNAME.eu/sitecore/api/ssc/horizon/sites/-/getsites?sc_horizon=api&IncludeSystemSites=False I can see valid json response.

It looks like identity server configuration is ok cause it allows to login from Horizon. And it looks like horizon config is ok as well - it sends requests to CM and CM receives them. But for some reason CM returns 401 for requests sent from Horizon.

I saw the other question related to Horizon reloading all the time ( SItecore 9.3 - Horizon - Page keeps on reloading issue ) but I do have Sitecore Identity Server enabled, so it's not the reason of my issues.

Any idea if I missed something?


EDIT

I found an exception in AI coming from CM server:

Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationMiddleware - Authentication failed   

Exception: Microsoft.IdentityModel.Tokens.SecurityTokenInvalidAudienceException
Message: IDX10214: Audience validation failed. Audiences: '[PII is hidden]'. Did not match: validationParameters.ValidAudience: '[PII is hidden]' or validationParameters.ValidAudiences: '[PII is hidden]'.
Source: Microsoft.IdentityModel.Tokens
   at Microsoft.IdentityModel.Tokens.Validators.ValidateAudience(IEnumerable`1 audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) in C:\agent2\_work\56\s\src\Microsoft.IdentityModel.Tokens\Validators.cs:line 108
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateTokenPayload(JwtSecurityToken jwtToken, TokenValidationParameters validationParameters) in C:\agent2\_work\56\s\src\System.IdentityModel.Tokens.Jwt\JwtSecurityTokenHandler.cs:line 737
   at Microsoft.Owin.Security.Jwt.JwtFormat.Unprotect(String protectedText)
   at Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationHandler.d__3.MoveNext()

I'm not sure if that's relevant. Adding here just in case.

7
  • Are there any errors in the Identity Server app logs? Jan 28 at 15:16
  • @AlessandroFaniuolo No errors. Only [INF] entries. But I found an exception in Application Insights coming from CM server. Potentially related. So I updated the question Jan 28 at 15:35
  • The ADFS audience validation failure seems to be caused by a domain mismatch. Do you see any internal Azure hostnames (<your_app_service>.azurewebsites.net) in the Identity Server logs records? Jan 28 at 22:39
  • @MarekMusielak Were you able to resolve this issue? I'm facing the same issue with my horizon site for sitecore 10.1
    – Indhumathi
    Jul 8 at 7:54
  • @MarekMusielak In my case it happened to be the Authentication issue and I resolved it by updating the Identity Server host name in the config file under the path: \App_Config\Sitecore\Owin.Authentication.IdentityServer\Sitecore.Owin.Authentication.IdentityServer.config. Please check if you have the correct host name in this configuration file.
    – Indhumathi
    Jul 15 at 14:02
2

In my case endless redirects were caused by 'Remove trailing slash' URL Rewrite rule on CM. Added condition to ignore requests from Horizon:

<add input="{REQUEST_URI}" pattern=".*(api/ssc/horizon).*" negate="true" />

So that the entire rule looks like the following in my 10.1.1 setup:

<rule name="Remove trailing slash" stopProcessing="true">
  <match url="(.*)/$" />
    <conditions>
      <add input="{REQUEST_URI}" pattern=".*(api/ma).*" negate="true" />
      <add input="{REQUEST_URI}" pattern=".*(api/ssc/horizon).*" negate="true" />
      <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
      <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
  </conditions>
  <action type="Redirect" redirectType="Permanent" url="{R:1}" />
</rule>
1

As you mentioned in your post, you have the correct host names of CM, Identity server and horizon site in all the configuration files you specified. The error is while loading [horizonsite]/composer/pages/, the site tries to do Owin authentication to Identity server but it fails and retries again and again. This causes to reload the horizon editor repeatedly.

This can be fixed by updating the correct hostname(if incorrect) of your identity site in the following configuration [CM]\App_Config\Sitecore\Owin.Authentication.IdentityServer\Sitecore.Owin.Authentication.IdentityServer.config

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.