1

I am using Federated Authentication with Auth0. Right after login, I get the following error:

ERROR [Sitecore.Owin.Authentication.Pipelines.Initialize.HandleLoginLink] 
Unable to get and an external login info via Microsoft.Owin.Security.AuthenticationManagerExtensions.GetExternalLoginInfoAsync. 
Most probably the identity does not have a 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier' claim.

As per the information in the website I added this on the config as well:

    <transformation name ="Name identifier claim" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
      <sources hint="raw:AddSource">
        <claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
      </sources>
      <targets hint="raw:AddTarget">
        <claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" />
      </targets>
      <keepSource>true</keepSource>
    </transformation>

public class Auth0IdentityProviderProcessor : IdentityProvidersProcessor
{
    public Auth0IdentityProviderProcessor(FederatedAuthenticationConfiguration federatedAuthenticationConfiguration, ICookieManager cookieManager, BaseSettings settings) : base(federatedAuthenticationConfiguration, cookieManager, settings)
    {
    }
    /// <summary>
    /// Identityprovider name. Has to match the configuration
    /// </summary>
    protected override string IdentityProviderName => "Auth0";
    protected IdentityProvider IdentityProvider { get; set; }
    protected override void ProcessCore(IdentityProvidersArgs args)
    {
        Assert.ArgumentNotNull(args, "args");
        IdentityProvider = this.GetIdentityProvider();
        // Configure Auth0 parameters
        string auth0Domain = Sitecore.Configuration.Settings.GetSetting("Auth0:Domain");
        string auth0ClientId = Sitecore.Configuration.Settings.GetSetting("Auth0:ClientId");

        string auth0RedirectUri = Sitecore.Configuration.Settings.GetSetting("Auth0:RedirectUri");
        string auth0PostLogoutRedirectUri = Sitecore.Configuration.Settings.GetSetting("Auth0:PostLogoutRedirectUri");

        AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.NameIdentifier;

        // Sequence of this middleware matters. The KentorOwinCookieSave must comes before OpenIdConnectAuthentication.
        args.App.UseKentorOwinCookieSaver();

        var options = new OpenIdConnectAuthenticationOptions
        {
            AuthenticationType = this.GetAuthenticationType(),

            Authority = $"https://{auth0Domain}",

            ClientId = auth0ClientId,

            RedirectUri = auth0RedirectUri,
            PostLogoutRedirectUri = auth0PostLogoutRedirectUri,

            ResponseType = OpenIdConnectResponseType.IdToken,
            Scope = "openid profile",

            TokenValidationParameters = new TokenValidationParameters
            {
                NameClaimType = "name"
            },

            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                SecurityTokenValidated = notification =>
                {
                    notification.AuthenticationTicket.Identity.AddClaim(new Claim("idp", "Auth0"));
                    notification.AuthenticationTicket.Identity.AddClaim(new Claim("id_token", notification.ProtocolMessage.IdToken));

                    return Task.FromResult(0);
                },
                RedirectToIdentityProvider = notification =>
                {
                    if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication)
                    {
                        // The context's ProtocolMessage can be used to pass along additional query parameters
                        // to Auth0's /authorize endpoint.
                        var paramsDictionary = notification.OwinContext.Request.Context.Authentication
                            .AuthenticationResponseChallenge?.Properties.Dictionary;

                        if (paramsDictionary != null && paramsDictionary.ContainsKey("screen_hint"))
                        {
                            notification.ProtocolMessage.SetParameter("screen_hint",
                                paramsDictionary["screen_hint"]);
                        }
                    }
                    else if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)
                    {
                        var logoutUri =
                            $"https://{auth0Domain}/v2/logout?client_id={auth0ClientId}";

                        var postLogoutUri = notification.ProtocolMessage.PostLogoutRedirectUri;
                        if (!string.IsNullOrEmpty(postLogoutUri))
                        {
                            if (postLogoutUri.StartsWith("/"))
                            {
                                // transform to absolute
                                var request = notification.Request;
                                postLogoutUri = request.Scheme + "://" + request.Host + request.PathBase +
                                                postLogoutUri;
                            }

                            logoutUri += $"&returnTo={Uri.EscapeDataString(postLogoutUri)}";
                        }

                        notification.Response.Redirect(logoutUri);
                        notification.HandleResponse();
                    }

                    return Task.FromResult(0);
                }
            }
        };

        // Configure Auth0 authentication
        args.App.UseOpenIdConnectAuthentication(options);
    }
}

I even tried the fix from this link: Federated authentication with OpenIDConnect gives "Unsuccessful login with external provider" Still the error persists. Any insights or suggestion would be really helpful. Thank you

2
  • 1
    Can you please post the code from your IdentityProvidersProcessor ?
    – Jeroen
    Sep 1 at 15:19
  • Hi @Jeroen I have updated the post to include the processor. Could you please have a look.
    – ashesh
    Sep 1 at 15:27
1

You are missing the code in SecurityTokenValidated event to call ApplyClaimsTransformations, it needs to include something like this (make sure to keep your other code there too:

private Task OnSecurityTokenValidated(SecurityTokenValidatedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> context) {
    TransformationContext transformationContext = new TransformationContext(FederatedAuthenticationConfiguration, GetIdentityProvider());
    context.AuthenticationTicket.Identity.ApplyClaimsTransformations(transformationContext);

    return Task.CompletedTask;
}
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.