Restrict access to site on subdomain

Question

I have backoffice functionality that should require Sitecore identity server logins with specific permissions/roles. It is hosted on its own Sitecore-site definition and subdomain, for example backoffice.mainsite.com.
I would like to restrict access to the site, requiring users to log in via Sitecore login.

Setup

I have tried the following guide from briancaos which states to:

• Set requireLogin = "true"
• Set the loginPage for the site definition

On the backoffice site definition I have set the loginPage property to /identity/login/shell/SitecoreIdentityServer. Furthermore, I have added the subdomain in AllowedCorsOriginsGroup2 in Sitecore.IdentityServer.Host.xml.

Problem

When I attempt to access the site I am correctly redirected to the Sitecore login page. So far, so good.
At this point, I have verified that the redirect_uri is pointing to "backoffice.mainsite.com".

From the Sitecore login page I can successfully log in. Upon successful login I am redirected back to backoffice.mainsite.com, which immediately redirects me back to the Sitecore login page.

Back at the Sitecore login page, I have verified that I am indeed logged in:

• I can see the username in the upper right corner of the page
• I can successfully navigate to and browse parent.local/sitecore

However, trying to access any page on backoffice.mainsite.com leads me to the Sitecore login page again.

So it seems that while I can successfully log in using the Sitecore login page, I can't actually log in as I cannot access the site. The Sitecore logs do not show any issues.

The site defition is shown below.

  <site name="customerserviceportal" patch:before="site[@name='website']"
        inherits="airshoppen-abstract-site-definition"
        hostName="csp.airshoppen.local"
        targetHostName="csp.airshoppen.local"
        language="en"
        rootPath="/sitecore/content/Customer Service Portal/"
        startItem="/Pages/CartSearchPage"
        requireLogin="true"
        domain="sitecore" <-- Added
        loginPage="/sitecore/login" <-- Thanks to @AlinaFodor
  />
  <site name="airshoppen-abstract-site-definition"
        virtualFolder="/"
        physicalFolder="/"
        startItem="/FrontPage"
        database="web"
        domain="extranet"
        allowDebug="true"
        cacheHtml="true"
        htmlCacheSize="50MB"
        enablePreview="true"
        enableWebEdit="true"
        enableDebugger="true"
        disableClientData="false"
        formsRoot="{F1F7AAB6-C8CE-422F-A214-F610C109FA63}"
        scheme="https"
        externalPort="80"
        enableItemLanguageFallback="true"
        enableFieldLanguageFallback="true"
        loginPage ="/"
  />

Can anyone help?

Answer 1

You can try to change your login page, in site definition like so: loginPage="/identity/login/[site name from site definition]/SitecoreIdentityServer" . Then, you need to configure that all your sites need to use Sitecore Identity Server as Identity Provider. Edit \App_Config\Sitecore\Owin.Authentication.IdentityServer\Sitecore.Owin.Authentication.IdentityServer.config Here, you need to uncomment the definition of Identity Provider for all sites, and change it to be Sitecore Identity Server, like so:

<!-- An example that maps a sub-provider of the Identity Server to the sites that are not mapped to the SitecoreIdentityServer. -->
 <mapEntry name="all sites">
          <identityProviders hint="list:AddIdentityProvider">
           <identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='SitecoreIdentityServer']" id="SitecoreIdentityServer" />
          </identityProviders>
  </mapEntry>

In same config file, at the bottom, add you site definition login page like so:

<site name="[site name from site definition]" set:loginPage="$(loginPath)[site name from site definition]/SitecoreIdentityServer" />
    </sites>