sitecore federated authentication GetOwinContext() doesn't have authenticated user info

Question

I am using Federated Authentication for external users login (Sitecore version 9.2) After the user is authenticated, User.Identity has is external\anonymous and doesn't have the claims returned by the login provider same for HttpContext.GetOwinContext().Authentication.User.Identity as well.

However, HttpContext.GetOwinContext().Authentication.AuthenticateAsync("ExternalCookie") returns correct identity and claims

Is there any Sitecore's pipeline/process that is causing so? Any insights to resolve it?

Answer 1

Without seeing your Federated Authentication setup it's a bit hard to guess what might be the problem.

Could you check in the SecurityTokenValidatedAsync event what your identity is?

For example:

public async Task SecurityTokenValidatedAsync(SecurityTokenValidatedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification)
{
    // What type of identity do you have here?
    var identity = notification.AuthenticationTicket.Identity;
}

There could also be a misconfiguration in your owin config. Here an example which I'm using and works:

<?xml version="1.0" encoding="UTF-8"?>
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
    <sitecore>
        <federatedAuthentication type="Sitecore.Owin.Authentication.Configuration.FederatedAuthenticationConfiguration, Sitecore.Owin.Authentication">
            <identityProvidersPerSites hint="list:AddIdentityProvidersPerSites">
                <mapEntry name="sites with extranet domain" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true" patch:instead="*[@name='sites with extranet domain']">
                    <sites hint="list">
                        <site>project</site>
                    </sites>
                    <identityProviders hint="list:AddIdentityProvider">
                        <identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='ProjectIdentityProvider']" />
                    </identityProviders>
                    <externalUserBuilder type="Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, Sitecore.Owin.Authentication" resolve="true">
                        <IsPersistentUser>false</IsPersistentUser>
                    </externalUserBuilder>
                </mapEntry>
            </identityProvidersPerSites>
            <identityProviders>
                <identityProvider id="ProjectIdentityProvider" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication">
                    <param desc="name">$(id)</param>
                    <param desc="domainManager" type="Sitecore.Abstractions.BaseDomainManager" resolve="true" />
                    <caption>Go to login</caption>
                    <domain>extranet</domain>
                    <triggerExternalSignOut>true</triggerExternalSignOut>
                    <!--list of identity transfromations which are applied to the provider when a user signin-->
                    <transformations hint="list:AddTransformation">
                        <!--SetIdpClaim transformation-->
                        <transformation name="Idp Claim" type="Sitecore.Owin.Authentication.Services.SetIdpClaimTransform, Sitecore.Owin.Authentication" />
                        <!-- If external authentication is configured with "TokenValidationParameters = {SaveSigninToken = true}", this saves the value from "claimsIdentity.BootstrapContext" to the "id_token" claim. -->
                        <transformation name="set id_token claim" type="Sitecore.Owin.Authentication.Services.SaveIdTokenInClaim, Sitecore.Owin.Authentication" />
                    </transformations>
                </identityProvider>
            </identityProviders>
        </federatedAuthentication>
        <pipelines>
            <owin.identityProviders>
                <processor type="Project.Foundation.Identity.IdentityProviders.ProjectIdentityProvider, Project.Foundation.Identity" resolve="true" id="ProjectIdentityProvider">
                    <scopes hint="list">
                        <scope name="openid">openid</scope>
                        <scope name="sitecore.profile">sitecore.profile</scope>
                    </scopes>
                </processor>
            </owin.identityProviders>

            <owin.initialize help="Processors should derive from Sitecore.Owin.Pipelines.Initialize.InitializeProcessor">
                <processor name="CookieAuthentication" type="Sitecore.Owin.Authentication.Pipelines.Initialize.CookieAuthentication, Sitecore.Owin.Authentication"
                           resolve="true" patch:before="processor[@method='Authenticate']">
                    <ExpireTimeSpan>01:00:00</ExpireTimeSpan>
                    <SlidingExpiration>true</SlidingExpiration>
                </processor>
            </owin.initialize>
        </pipelines>
    </sitecore>
</configuration>

I hope this helps.