I am using Federated Authentication with Auth0. Right after login, I get the following error:
ERROR [Sitecore.Owin.Authentication.Pipelines.Initialize.HandleLoginLink]
Unable to get and an external login info via Microsoft.Owin.Security.AuthenticationManagerExtensions.GetExternalLoginInfoAsync.
Most probably the identity does not have a 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier' claim.
As per the information in the website I added this on the config as well:
<transformation name ="Name identifier claim" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
<sources hint="raw:AddSource">
<claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
</sources>
<targets hint="raw:AddTarget">
<claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" />
</targets>
<keepSource>true</keepSource>
</transformation>
public class Auth0IdentityProviderProcessor : IdentityProvidersProcessor
{
public Auth0IdentityProviderProcessor(FederatedAuthenticationConfiguration federatedAuthenticationConfiguration, ICookieManager cookieManager, BaseSettings settings) : base(federatedAuthenticationConfiguration, cookieManager, settings)
{
}
/// <summary>
/// Identityprovider name. Has to match the configuration
/// </summary>
protected override string IdentityProviderName => "Auth0";
protected IdentityProvider IdentityProvider { get; set; }
protected override void ProcessCore(IdentityProvidersArgs args)
{
Assert.ArgumentNotNull(args, "args");
IdentityProvider = this.GetIdentityProvider();
// Configure Auth0 parameters
string auth0Domain = Sitecore.Configuration.Settings.GetSetting("Auth0:Domain");
string auth0ClientId = Sitecore.Configuration.Settings.GetSetting("Auth0:ClientId");
string auth0RedirectUri = Sitecore.Configuration.Settings.GetSetting("Auth0:RedirectUri");
string auth0PostLogoutRedirectUri = Sitecore.Configuration.Settings.GetSetting("Auth0:PostLogoutRedirectUri");
AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.NameIdentifier;
// Sequence of this middleware matters. The KentorOwinCookieSave must comes before OpenIdConnectAuthentication.
args.App.UseKentorOwinCookieSaver();
var options = new OpenIdConnectAuthenticationOptions
{
AuthenticationType = this.GetAuthenticationType(),
Authority = $"https://{auth0Domain}",
ClientId = auth0ClientId,
RedirectUri = auth0RedirectUri,
PostLogoutRedirectUri = auth0PostLogoutRedirectUri,
ResponseType = OpenIdConnectResponseType.IdToken,
Scope = "openid profile",
TokenValidationParameters = new TokenValidationParameters
{
NameClaimType = "name"
},
Notifications = new OpenIdConnectAuthenticationNotifications
{
SecurityTokenValidated = notification =>
{
notification.AuthenticationTicket.Identity.AddClaim(new Claim("idp", "Auth0"));
notification.AuthenticationTicket.Identity.AddClaim(new Claim("id_token", notification.ProtocolMessage.IdToken));
return Task.FromResult(0);
},
RedirectToIdentityProvider = notification =>
{
if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication)
{
// The context's ProtocolMessage can be used to pass along additional query parameters
// to Auth0's /authorize endpoint.
var paramsDictionary = notification.OwinContext.Request.Context.Authentication
.AuthenticationResponseChallenge?.Properties.Dictionary;
if (paramsDictionary != null && paramsDictionary.ContainsKey("screen_hint"))
{
notification.ProtocolMessage.SetParameter("screen_hint",
paramsDictionary["screen_hint"]);
}
}
else if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)
{
var logoutUri =
$"https://{auth0Domain}/v2/logout?client_id={auth0ClientId}";
var postLogoutUri = notification.ProtocolMessage.PostLogoutRedirectUri;
if (!string.IsNullOrEmpty(postLogoutUri))
{
if (postLogoutUri.StartsWith("/"))
{
// transform to absolute
var request = notification.Request;
postLogoutUri = request.Scheme + "://" + request.Host + request.PathBase +
postLogoutUri;
}
logoutUri += $"&returnTo={Uri.EscapeDataString(postLogoutUri)}";
}
notification.Response.Redirect(logoutUri);
notification.HandleResponse();
}
return Task.FromResult(0);
}
}
};
// Configure Auth0 authentication
args.App.UseOpenIdConnectAuthentication(options);
}
}
I even tried the fix from this link: Federated authentication with OpenIDConnect gives "Unsuccessful login with external provider" Still the error persists. Any insights or suggestion would be really helpful. Thank you
IdentityProvidersProcessor
?