TL;DR: Sitecore services client 403 when login called from different web application (IIS process), but not when called from Postman
SYMPTOMS: Calling /sitecore/api/ssc/auth/login works with Postman and a console test app I wrote to POST data. These work after I changed the "Sitecore.Services.Client.config" file from the default "ServicesLocalOnlyPolicy" to "ServicesOnPolicy".
Worked with Sitecore v8.x, but stopped working once we upgraded to Sitecore v9.x
WHAT I'VE TRIED:
- Other settings changed, but have no affect, in the sitecore services client config:
<setting name="Sitecore.Services.AllowToLoginWithHttp" value="true" /> <setting name="Sitecore.Services.AllowAnonymousUser" value="true" />
Searched Google, StackExchange, StackOverflow, and I read the sitecore documentation ("Developer's Guide to Sitecore.Services.Client"), but no resolution.
I checked IIS logs for more detail on the 403, but nothing.
Nothing in the sitecore logs - I don't see anything regarding this error.
What else should I check?