I am using Federated Authentication with Auth0. Right after login, I get the following error:

ERROR [Sitecore.Owin.Authentication.Pipelines.Initialize.HandleLoginLink] 
Unable to get and an external login info via Microsoft.Owin.Security.AuthenticationManagerExtensions.GetExternalLoginInfoAsync. 
Most probably the identity does not have a 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier' claim.

As per the information in the website I added this on the config as well:

    <transformation name ="Name identifier claim" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
      <sources hint="raw:AddSource">
        <claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
      <targets hint="raw:AddTarget">
        <claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" />

public class Auth0IdentityProviderProcessor : IdentityProvidersProcessor
    public Auth0IdentityProviderProcessor(FederatedAuthenticationConfiguration federatedAuthenticationConfiguration, ICookieManager cookieManager, BaseSettings settings) : base(federatedAuthenticationConfiguration, cookieManager, settings)
    /// <summary>
    /// Identityprovider name. Has to match the configuration
    /// </summary>
    protected override string IdentityProviderName => "Auth0";
    protected IdentityProvider IdentityProvider { get; set; }
    protected override void ProcessCore(IdentityProvidersArgs args)
        Assert.ArgumentNotNull(args, "args");
        IdentityProvider = this.GetIdentityProvider();
        // Configure Auth0 parameters
        string auth0Domain = Sitecore.Configuration.Settings.GetSetting("Auth0:Domain");
        string auth0ClientId = Sitecore.Configuration.Settings.GetSetting("Auth0:ClientId");

        string auth0RedirectUri = Sitecore.Configuration.Settings.GetSetting("Auth0:RedirectUri");
        string auth0PostLogoutRedirectUri = Sitecore.Configuration.Settings.GetSetting("Auth0:PostLogoutRedirectUri");

        AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.NameIdentifier;

        // Sequence of this middleware matters. The KentorOwinCookieSave must comes before OpenIdConnectAuthentication.

        var options = new OpenIdConnectAuthenticationOptions
            AuthenticationType = this.GetAuthenticationType(),

            Authority = $"https://{auth0Domain}",

            ClientId = auth0ClientId,

            RedirectUri = auth0RedirectUri,
            PostLogoutRedirectUri = auth0PostLogoutRedirectUri,

            ResponseType = OpenIdConnectResponseType.IdToken,
            Scope = "openid profile",

            TokenValidationParameters = new TokenValidationParameters
                NameClaimType = "name"

            Notifications = new OpenIdConnectAuthenticationNotifications
                SecurityTokenValidated = notification =>
                    notification.AuthenticationTicket.Identity.AddClaim(new Claim("idp", "Auth0"));
                    notification.AuthenticationTicket.Identity.AddClaim(new Claim("id_token", notification.ProtocolMessage.IdToken));

                    return Task.FromResult(0);
                RedirectToIdentityProvider = notification =>
                    if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication)
                        // The context's ProtocolMessage can be used to pass along additional query parameters
                        // to Auth0's /authorize endpoint.
                        var paramsDictionary = notification.OwinContext.Request.Context.Authentication

                        if (paramsDictionary != null && paramsDictionary.ContainsKey("screen_hint"))
                    else if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)
                        var logoutUri =

                        var postLogoutUri = notification.ProtocolMessage.PostLogoutRedirectUri;
                        if (!string.IsNullOrEmpty(postLogoutUri))
                            if (postLogoutUri.StartsWith("/"))
                                // transform to absolute
                                var request = notification.Request;
                                postLogoutUri = request.Scheme + "://" + request.Host + request.PathBase +

                            logoutUri += $"&returnTo={Uri.EscapeDataString(postLogoutUri)}";


                    return Task.FromResult(0);

        // Configure Auth0 authentication

I even tried the fix from this link: Federated authentication with OpenIDConnect gives "Unsuccessful login with external provider" Still the error persists. Any insights or suggestion would be really helpful. Thank you

  • 1
    Can you please post the code from your IdentityProvidersProcessor ?
    – Jeroen
    Commented Sep 1, 2021 at 15:19
  • Hi @Jeroen I have updated the post to include the processor. Could you please have a look.
    – manaslu
    Commented Sep 1, 2021 at 15:27

2 Answers 2


You are missing the code in SecurityTokenValidated event to call ApplyClaimsTransformations, it needs to include something like this (make sure to keep your other code there too:

private Task OnSecurityTokenValidated(SecurityTokenValidatedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> context) {
    TransformationContext transformationContext = new TransformationContext(FederatedAuthenticationConfiguration, GetIdentityProvider());

    return Task.CompletedTask;

I am little late to the question, but hopefully it should help. I was getting the same issue for 10.2 FAL login with an external identifier(Not Sitecore) in my local instance. I was having the above mentioned task for transforming the sub claim to name identifier claim. The code was working exactly fine for transforming but somehow the http context was getting lost when this was method was executing Microsoft.Owin.Security.AuthenticationManagerExtensions.GetExternalLoginInfoAsync().

After making my local https enabled by assigning a self signed certificate, it began to work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.