Error: Unsuccessful login with external provider - Sitecore 10.1 integration with Google SSO

Question

We are trying to integrate google single sign on with sitecore 10.1 (only Sitecore cms login). When we login using google, for the first time we get an error "Error: Unsuccessful login with external provider."

Sitecore Log file : ERROR Unable to get and an external login info via Microsoft.Owin.Security.AuthenticationManagerExtensions.GetExternalLoginInfoAsync. Most probably the identity does not have a 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier' claim.

Owin Log file : Microsoft.Owin.Security.Google.GoogleOAuth2AuthenticationMiddleware - .AspNet.Correlation.Google cookie not found.

Now when we refresh the page "/sitecore/login" we are able to successfully login and the user is created in the sitecore. Hence the authentication is successful but looks like the cookie is not created at the time of redirection.

When we login for the first time we don't see any cookies being created. But when we refresh we see few cookies created. sitecore_userticket, .Asp.Net.Cookies and Asp.Net.Correlation Cookie.

Fiddler Screen shot:

Identity Provider Config

<identityProvider id="Google" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication">
          <param desc="name">$(id)</param>
          <param desc="domainManager" type="Sitecore.Abstractions.BaseDomainManager" resolve="true" />
          <!--This text will be showed for button-->
          <caption>Log in with Google</caption>
          <icon>/sitecore/shell/themes/standard/Images/24x24/Google.jpg</icon>
          <!--Domain name which will be added when create a user-->
          <domain>sitecore</domain>
          <triggerExternalSignOut>true</triggerExternalSignOut>
          <!--list of identity transfromations which are applied to the provider when a user signin-->
          <transformations hint="list:AddTransformation">
            <!--SetIdpClaim transformation-->
            <transformation name="set idp claim" type="Sitecore.Owin.Authentication.Services.SetIdpClaimTransform, Sitecore.Owin.Authentication" />
            <!--transformation for Google provider-->
            <transformation name="devRole" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
              <sources hint="raw:AddSource">
                <claim name="idp" value="Google" />
              </sources>
              <targets hint="raw:AddTarget">
                <claim name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" value="Sitecore\Developer" />
              </targets>
              <keepSource>true</keepSource>
            </transformation>           
          </transformations>
        </identityProvider> 

Answer 1

I think it's saying it cannot resolve name claim from the id token. Make sure the claims have name and also add following to idp config

<ClaimsTransformations>
                                    <ClaimsTransformation1 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
                                        <SourceClaims>
                                            <Claim1 type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" />
                                        </SourceClaims>
                                        <NewClaims>
                                            <Claim1 type="name" />
                                        </NewClaims>
                                    </ClaimsTransformation1 >
    </ClaimsTransformations>

Answer 2

Finally found solution for this issue.

As mentioned in the question there was some issue with cookies as it was not able to login for the first attempt but latter on it was successfully logging in.

I added below line to make it work.

googleOptions.CookieManager = base.CookieManager;

Now it successfully logins even in the first attempt.