Sitecore Federated Authentication unable to login Unable to get and an external login info

Question

I am using Federated Authentication with Auth0. Right after login, I get the following error:

ERROR [Sitecore.Owin.Authentication.Pipelines.Initialize.HandleLoginLink] 
Unable to get and an external login info via Microsoft.Owin.Security.AuthenticationManagerExtensions.GetExternalLoginInfoAsync. 
Most probably the identity does not have a 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier' claim.

As per the information in the website I added this on the config as well:

    <transformation name ="Name identifier claim" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
      <sources hint="raw:AddSource">
        <claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
      </sources>
      <targets hint="raw:AddTarget">
        <claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" />
      </targets>
      <keepSource>true</keepSource>
    </transformation>

public class Auth0IdentityProviderProcessor : IdentityProvidersProcessor
{
    public Auth0IdentityProviderProcessor(FederatedAuthenticationConfiguration federatedAuthenticationConfiguration, ICookieManager cookieManager, BaseSettings settings) : base(federatedAuthenticationConfiguration, cookieManager, settings)
    {
    }
    /// <summary>
    /// Identityprovider name. Has to match the configuration
    /// </summary>
    protected override string IdentityProviderName => "Auth0";
    protected IdentityProvider IdentityProvider { get; set; }
    protected override void ProcessCore(IdentityProvidersArgs args)
    {
        Assert.ArgumentNotNull(args, "args");
        IdentityProvider = this.GetIdentityProvider();
        // Configure Auth0 parameters
        string auth0Domain = Sitecore.Configuration.Settings.GetSetting("Auth0:Domain");
        string auth0ClientId = Sitecore.Configuration.Settings.GetSetting("Auth0:ClientId");

        string auth0RedirectUri = Sitecore.Configuration.Settings.GetSetting("Auth0:RedirectUri");
        string auth0PostLogoutRedirectUri = Sitecore.Configuration.Settings.GetSetting("Auth0:PostLogoutRedirectUri");

        AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.NameIdentifier;

        // Sequence of this middleware matters. The KentorOwinCookieSave must comes before OpenIdConnectAuthentication.
        args.App.UseKentorOwinCookieSaver();

        var options = new OpenIdConnectAuthenticationOptions
        {
            AuthenticationType = this.GetAuthenticationType(),

            Authority = $"https://{auth0Domain}",

            ClientId = auth0ClientId,

            RedirectUri = auth0RedirectUri,
            PostLogoutRedirectUri = auth0PostLogoutRedirectUri,

            ResponseType = OpenIdConnectResponseType.IdToken,
            Scope = "openid profile",

            TokenValidationParameters = new TokenValidationParameters
            {
                NameClaimType = "name"
            },

            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                SecurityTokenValidated = notification =>
                {
                    notification.AuthenticationTicket.Identity.AddClaim(new Claim("idp", "Auth0"));
                    notification.AuthenticationTicket.Identity.AddClaim(new Claim("id_token", notification.ProtocolMessage.IdToken));

                    return Task.FromResult(0);
                },
                RedirectToIdentityProvider = notification =>
                {
                    if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication)
                    {
                        // The context's ProtocolMessage can be used to pass along additional query parameters
                        // to Auth0's /authorize endpoint.
                        var paramsDictionary = notification.OwinContext.Request.Context.Authentication
                            .AuthenticationResponseChallenge?.Properties.Dictionary;

                        if (paramsDictionary != null && paramsDictionary.ContainsKey("screen_hint"))
                        {
                            notification.ProtocolMessage.SetParameter("screen_hint",
                                paramsDictionary["screen_hint"]);
                        }
                    }
                    else if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)
                    {
                        var logoutUri =
                            $"https://{auth0Domain}/v2/logout?client_id={auth0ClientId}";

                        var postLogoutUri = notification.ProtocolMessage.PostLogoutRedirectUri;
                        if (!string.IsNullOrEmpty(postLogoutUri))
                        {
                            if (postLogoutUri.StartsWith("/"))
                            {
                                // transform to absolute
                                var request = notification.Request;
                                postLogoutUri = request.Scheme + "://" + request.Host + request.PathBase +
                                                postLogoutUri;
                            }

                            logoutUri += $"&returnTo={Uri.EscapeDataString(postLogoutUri)}";
                        }

                        notification.Response.Redirect(logoutUri);
                        notification.HandleResponse();
                    }

                    return Task.FromResult(0);
                }
            }
        };

        // Configure Auth0 authentication
        args.App.UseOpenIdConnectAuthentication(options);
    }
}

I even tried the fix from this link: Federated authentication with OpenIDConnect gives "Unsuccessful login with external provider" Still the error persists. Any insights or suggestion would be really helpful. Thank you

Answer 1

You are missing the code in SecurityTokenValidated event to call ApplyClaimsTransformations, it needs to include something like this (make sure to keep your other code there too:

private Task OnSecurityTokenValidated(SecurityTokenValidatedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> context) {
    TransformationContext transformationContext = new TransformationContext(FederatedAuthenticationConfiguration, GetIdentityProvider());
    context.AuthenticationTicket.Identity.ApplyClaimsTransformations(transformationContext);

    return Task.CompletedTask;
}