Sitecore services client 403 when login called from different web application

Question

TL;DR: Sitecore services client 403 when login called from a different web application (IIS process), but not when called from Postman

PROBLEM: RESTful Web API (web service) written in C# running on IIS/Azure (different machine than Sitecore) calling Sitecore services client. Calling the endpoint /sitecore/api/ssc/auth/login over the network via HTTP always returns HTTP status code 403 Forbidden.

To be clear: I am using the Sitecore Restful API directly. Not using JavaScript. Not using SPEAK components.

SYMPTOMS: Calling /sitecore/api/ssc/auth/login works with Postman and a console test app I wrote to POST data. These work after I changed the "Sitecore.Services.Client.config" file from the default "ServicesLocalOnlyPolicy" to "ServicesOnPolicy".

Worked with Sitecore v8.x, but stopped working once we upgraded to Sitecore v9.x

WHAT I'VE TRIED:

• Other settings changed, but have no affect, in the Sitecore services client config:

<setting name="Sitecore.Services.AllowToLoginWithHttp" value="true" />
<setting name="Sitecore.Services.AllowAnonymousUser" value="true" />

• Searched Google, StackExchange, StackOverflow, and I read the Sitecore documentation ("Developer's Guide to Sitecore.Services.Client"), but no resolution.

• I checked IIS logs for more detail on the 403, but nothing.

• Nothing in the Sitecore logs - I don't see anything regarding this error.

What else should I check?

Answer 1

By default, Sitecore services can be accessed from the local host machine only without log in (ServicesLocalOnlyPolicy). ServicesOnPolicy will allow you to log in through "/sitecore/api/ssc/auth/login" and get the necessary token/cookie depending on your setup. If you want to bypass this behavior you can add your controller to allowed controllers section.

     <api>
       <services>
        <configuration type="Sitecore.Services.Infrastructure.Configuration.ServicesConfiguration, Sitecore.Services.Infrastructure">
          <allowedControllers hint="list:AddController">
            <allowedController desc="MyController">MyNamespace, MyDll</allowedController>
          </allowedControllers>
        </configuration>
      </services>
    </api>