We are building a DXP solution for our customers that requires Federated Authentication (via Azure AD). The solution is built on top of Sitecore JSS using Angular. The documentation related to Federated Authentication in JSS states:

"This approach does not work in headless or connected modes, because it depends on browser requests directly to Sitecore."

see: https://doc.sitecore.com/xp/en/developers/hd/190/sitecore-headless-development/enable-sitecore-integrated-federated-authentication.html

On the other hand, the official documentation also states regarding performance considerations "Avoid running applications in integrated mode on Sitecore Content Delivery servers."

see: https://doc.sitecore.com/xp/en/developers/hd/190/sitecore-headless-development/optimizing-the-performance-of-jss-apps.html

My question is:

What is the officially supported and recommended setup to use JSS with Federated Authentication in production environments?

Thanks in advance

1 Answer 1


I have a Sitecore JSS website using React in production that also uses Federated Authentication. I did run into some issues, but it does work if you're using cookies.

I wrote a blogpost about the setup: http://www.jeroenbreuer.nl/blog/custom-identity-provider-in-sitecore/

  • Would be great to fine tune this answer with code from your blog post and refer blog post at the end so if blog does not exists anymore, this answer will be still relevant... Mar 16, 2022 at 16:00
  • The code is also available on Gist so even if the blog does not exist anymore that will still be there: gist.github.com/jbreuer/ed69146f63aa1b20058092ab382ee0a7 Mar 16, 2022 at 16:09
  • Your answer is in another castle. meta.stackexchange.com/questions/225370/… Mar 16, 2022 at 16:35
  • Not sure why this was downvoted. I understand the "Your answer is in another castle." comment because I reference a blogpost. But I already give an answer before I add the blogpost. That is just there as extra proof to support my answer. Mar 17, 2022 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.