TL;DR: Sitecore services client 403 when login called from a different web application (IIS process), but not when called from Postman
RESTful Web API (web service) written in C# running on IIS/Azure (different machine than Sitecore) calling Sitecore services client. Calling the endpoint
/sitecore/api/ssc/auth/login over the network via HTTP always returns HTTP status code 403 Forbidden.
/sitecore/api/ssc/auth/login works with Postman and a console test app I wrote to POST data. These work after I changed the "Sitecore.Services.Client.config" file from the default "ServicesLocalOnlyPolicy" to "ServicesOnPolicy".
Worked with Sitecore v8.x, but stopped working once we upgraded to Sitecore v9.x
WHAT I'VE TRIED:
- Other settings changed, but have no affect, in the Sitecore services client config:
<setting name="Sitecore.Services.AllowToLoginWithHttp" value="true" /> <setting name="Sitecore.Services.AllowAnonymousUser" value="true" />
Searched Google, StackExchange, StackOverflow, and I read the Sitecore documentation ("Developer's Guide to Sitecore.Services.Client"), but no resolution.
I checked IIS logs for more detail on the 403, but nothing.
Nothing in the Sitecore logs - I don't see anything regarding this error.
What else should I check?