2

We have a load balanced v9.3 CM environment with 3 CMs and 1 Identity Server. The load balanced URL is https://test-cm.myclient.com/sitecore. The client would like to also be able to sign in to a single particular CM node for troubleshooting purposes. The AllowedCorsOrigins config in my Identity Server looks like this:

    <DefaultClient>
      <AllowedCorsOrigins>
        <AllowedCorsOriginsGroup1>https://test-cm.myclient.com|https://test-cm-1.myclient.com|https://test-cm-2.myclient.com|https://test-cm-3.myclient.com</AllowedCorsOriginsGroup1>
      </AllowedCorsOrigins>
    </DefaultClient>

If I open a browser and go to https://test-cm.myclient.com/sitecore it redirects me to the Identity Server (https://identity.myclient.com) like I would expect. However I get an error on the Identity Server sign in page that says:

Sorry, there was an error: unauthorized_client

When I look in the Identity Server logs I see the following:

Invalid redirect_uri: http://test-cm.myclient.com/identity/signin

Notice that the redirect_uri in the logs is HTTP and not HTTPS. If I go and modify my AllowedCorsOrigins to include the HTTP version of the URLs then I don't get that error anymore. However I can't sign in because it attempts to POST back to the HTTP version of the URL and that fails.

I don't understand why when Sitecore redirects to the Identity Server it is sending along the HTTP version of the redirect_uri. I guess maybe I don't know how Sitecore constructs that redirect_uri when it redirects you to Identity Server.

NOTE: Originally I had set the following setting in Sitecore.Owin.Authentication.IdentityServer.config on each CM:

<setting name="FederatedAuthentication.IdentityServer.CallbackAuthority" value="https://test-cm.myclient.com" />

When I had that setting everything works except you can't sign in to an individual node without changing this setting. Ideally I would like to be able to sign in to either the load balance URL or an individual CM node if needed. So I commented out this setting on each CM node.

UPDATE/SOLUTION: Thanks to Marek's answer I realized that what I had to do was create an outbound rule that modified the querystring and looked for redirect_uri and changed it from HTTP to HTTPS. However it is even a little more complicated than that because the redirect_uri data is escaped because it will be decoded later. So the outbound rule that worked for me looks like this:

<rewrite>
    <outboundRules>
      <rule name="Change Redirect URI" preCondition="IsRedirect">
        <match serverVariable="RESPONSE_LOCATION" pattern="(.*)redirect_uri=http%3a(.*)" />
        <action type="Rewrite" value="{R:1}redirect_uri=https%3a{R:2}" />
      </rule>
      <preConditions>
        <preCondition name="IsRedirect">
          <add input="{RESPONSE_STATUS}" pattern="3\d\d" />
        </preCondition>
      </preConditions>
    </outboundRules>
</rewrite>
1
  • could you please try by adding different nodes for AllowedCorsOriginsGroup - <AllowedCorsOriginsGroup1>https://test-cm.myclient.com|http://test-cm.myclient.com</AllowedCorsOriginsGroup1> <AllowedCorsOriginsGroup2>https://test-cm-1.myclient.com|http://test-cm-1.myclient.com</AllowedCorsOriginsGroup2> <AllowedCorsOriginsGroup3>https://test-cm-2.myclient.com|http://test-cm-2.myclient.com</AllowedCorsOriginsGroup3> <AllowedCorsOriginsGroup4>https://test-cm-3.myclient.com|http://test-cm-3.myclient.com</AllowedCorsOriginsGroup4> Aug 11 at 4:03
2

Do you offload SSL on your load balancer for https://test-cm-1.myclient.com and https://test-cm-2.myclient.com?

It looks like https is handled on load balancer and requests to your website go with http for those 2.

And when request is sent to Identity Server from your CM instances, callback url is set to http as well as this is what your IIS on CM server received.

Maybe an outbound rule on each of CM servers would help? It's written in notepad and not tested on the server, so it may need some adaptation:

<system.webServer>
  <rewrite>
    <outboundRules>
      <rule name="HttpToHttpsOutbound" preCondition="IsRedirect">
        <match serverVariable="RESPONSE_Location" pattern="^http://test-cm-1.myclient.com/(.*)" />
        <action type="Rewrite" value="https://test-cm-1.myclient.com/{R:1}" />
      </rule>
      <preConditions>
        <preCondition name="IsRedirect">
          <add input="{RESPONSE_STATUS}" pattern="3\d\d" />
        </preCondition>
      </preConditions>
    </outboundRules>
  </rewrite>
</system.webServer>

EDIT

You should be able to modify redirect_uri parameter with outbound rule on your CM. It should search for redirect_uri parameter and if it is HTTP, change it to HTTPS.

You can read more about it here:

https://stackoverflow.com/questions/59886697/iis-url-rewrite-for-modifying-query-parameter-on-outbound-redirect-response

6
  • I tried that but it didn't work. I am guessing that what is happening is that the individual CM node receives a request from the LB over HTTP. And Sitecore uses the protocol and hostname of that request (HTTP in this case) to generate the redirect_uri that it sends to Identity Server. So I am not sure if an outbound rule would really help anything. Aug 11 at 14:39
  • I think you diagnosed the problem correctly. But I am wondering if the only solution is to change the load balancer so that it communicates with the CM nodes over HTTPS. Aug 11 at 15:07
  • That would require to install certificate on CM nodes as well and use it for the binding. Outbound rule doesn't work for you? Aug 12 at 6:24
  • No, outbound rule doesn't work. What I think is happening here is that the CM receives a request over HTTP from the LB. The CM then responds with a redirect to the Identity Server. In the URL for that redirect to the Identity Server it includes the redirect_uri in the query string. And because the initial request from the LB was over HTTP, the redirect_uri that it sends back in the query string is also HTTP. An outbound rewrite rule won't change that. Unless of course I am misunderstanding how this all works. Aug 12 at 13:24
  • You should be able to modify redirect_uri parameter with outbound rule as well. stackoverflow.com/questions/59886697/… Aug 12 at 13:52
0

Have you patched your Sitecore config?

<?xml version="1.0" encoding="utf-8"?>
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/" xmlns:set="http://www.sitecore.net/xmlconfig/set/" >
  <sitecore role:require="Standalone or ContentDelivery or ContentManagement">
    <sc.variable name="identityServerAuthority" value="https://identity.server" />
    <settings>
      <!-- Fill the FederatedAuthentication.IdentityServer.CallbackAuthority setting if you need another host to receive callbacks from IdentityServer. It is useful for reverse proxy configuration. -->
      <setting name="FederatedAuthentication.IdentityServer.CallbackAuthority" value="https://test-cm.myclient.com" />
    </settings>
  </sitecore>
</configuration>

This blog post may be useful

1
  • We tried that. But it seems that if you have the CallbackAuthority set then you can never sign in to a single CM node. We want to be able to sign in to either the load balanced URL or an individual CM node. Aug 11 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.