1

I have backoffice functionality that should require Sitecore identity server logins with specific permissions/roles. It is hosted on its own Sitecore-site definition and subdomain, for example backoffice.mainsite.com.
I would like to restrict access to the site, requiring users to log in via Sitecore login.

Setup

I have tried the following guide from briancaos which states to:

  • Set requireLogin = "true"
  • Set the loginPage for the site definition

On the backoffice site definition I have set the loginPage property to /identity/login/shell/SitecoreIdentityServer. Furthermore, I have added the subdomain in AllowedCorsOriginsGroup2 in Sitecore.IdentityServer.Host.xml.

Problem

When I attempt to access the site I am correctly redirected to the Sitecore login page. So far, so good.
At this point, I have verified that the redirect_uri is pointing to "backoffice.mainsite.com".

From the Sitecore login page I can successfully log in. Upon successful login I am redirected back to backoffice.mainsite.com, which immediately redirects me back to the Sitecore login page.

Back at the Sitecore login page, I have verified that I am indeed logged in:

  • I can see the username in the upper right corner of the page
  • I can successfully navigate to and browse parent.local/sitecore

However, trying to access any page on backoffice.mainsite.com leads me to the Sitecore login page again.

So it seems that while I can successfully log in using the Sitecore login page, I can't actually log in as I cannot access the site. The Sitecore logs do not show any issues.

The site defition is shown below.

  <site name="customerserviceportal" patch:before="site[@name='website']"
        inherits="airshoppen-abstract-site-definition"
        hostName="csp.airshoppen.local"
        targetHostName="csp.airshoppen.local"
        language="en"
        rootPath="/sitecore/content/Customer Service Portal/"
        startItem="/Pages/CartSearchPage"
        requireLogin="true"
        domain="sitecore" <-- Added
        loginPage="/sitecore/login" <-- Thanks to @AlinaFodor
  />
  <site name="airshoppen-abstract-site-definition"
        virtualFolder="/"
        physicalFolder="/"
        startItem="/FrontPage"
        database="web"
        domain="extranet"
        allowDebug="true"
        cacheHtml="true"
        htmlCacheSize="50MB"
        enablePreview="true"
        enableWebEdit="true"
        enableDebugger="true"
        disableClientData="false"
        formsRoot="{F1F7AAB6-C8CE-422F-A214-F610C109FA63}"
        scheme="https"
        externalPort="80"
        enableItemLanguageFallback="true"
        enableFieldLanguageFallback="true"
        loginPage ="/"
  />

Can anyone help?

3
  • Is your backoffice site domain Extranet (check site definition domain property), and are you logging in Sitecore with an Extranet or Sitecore user? Mar 30 at 13:34
  • @AlinaFodor The domain is set to "sitecore". I am logging in with the admin user.
    – sgu
    Mar 31 at 7:24
  • @AlinaFodor I was wrong. The domain was set to "extranet". That said, changing it to "sitecore" did not change anything.
    – sgu
    Mar 31 at 11:03
0

You can try to change your login page, in site definition like so: loginPage="/identity/login/[site name from site definition]/SitecoreIdentityServer" . Then, you need to configure that all your sites need to use Sitecore Identity Server as Identity Provider. Edit \App_Config\Sitecore\Owin.Authentication.IdentityServer\Sitecore.Owin.Authentication.IdentityServer.config Here, you need to uncomment the definition of Identity Provider for all sites, and change it to be Sitecore Identity Server, like so:

<!-- An example that maps a sub-provider of the Identity Server to the sites that are not mapped to the SitecoreIdentityServer. -->
 <mapEntry name="all sites">
          <identityProviders hint="list:AddIdentityProvider">
           <identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='SitecoreIdentityServer']" id="SitecoreIdentityServer" />
          </identityProviders>
  </mapEntry>

In same config file, at the bottom, add you site definition login page like so:

<site name="[site name from site definition]" set:loginPage="$(loginPath)[site name from site definition]/SitecoreIdentityServer" />
    </sites>
3
  • That worked insofar as it allows me to log in. It takes me to the Sitecore Launchpad, however. I have updated the post with the site definition (including your change).
    – sgu
    Mar 31 at 11:05
  • @sgu to protect a site for visitors and authenticate visitors with Sitecore identity server you need to follow Sitecore documentation: doc.sitecore.com/developers/92/sitecore-experience-manager/en/…. By default Sitecore Identity Server is used for access to backend (context site: shell). Please see above answer updated with required changes Apr 1 at 8:28
  • Those changes seems to have done the trick. Although I have also added csp.airshoppen.local to AllowedCorsOriginsGroup2 in Sitecore.IdentityServer.Host.xml. I can't figure out if that it required or not.
    – sgu
    Apr 6 at 9:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.