I'm running Sitecore 10.1 with default, out of the box Sitecore Identity enabled as per Sitecore.Owin.Authentication.config. Auth for regular users into the Content Editor works.
I used to be on Sitecore 8.2, so it had no Identity Server. Before upgrading, I was utilising the Sitecore Services Client via the auth endpoint /sitecore/api/ssc/auth/login to POST credentials to.
After the upgrade, the /sitecore/api/ssc/auth/login endpoint now fails but ONLY when the OWIN/Identity Server config is enabled. If I enable the example config file Sitecore.Owin.Authentication.IdentityServer.Disabler.config.example (which turns off Sitecore Identity entirely) then it works no problem.
With Sitecore Identity enabled, I get the following exception in the logs:
4824 11:55:24 ERROR Application error.
Exception: System.InvalidOperationException
Message:
Source: Microsoft.Owin.Host.SystemWeb
at Microsoft.Owin.Host.SystemWeb.OwinCallContext.OnStart()
at Microsoft.Owin.Host.SystemWeb.OwinCallContext.OnEnd()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at Microsoft.Owin.Host.SystemWeb.CallContextAsyncResult.End(IAsyncResult result)
at Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.IntegratedPipelineContext.<DoFinalWork>d__12.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.StageAsyncResult.End(IAsyncResult ar)
at System.Web.HttpApplication.AsyncEventExecutionStep.<>c__DisplayClass11_0.<InvokeEndHandler>b__0()
at System.Web.HttpApplication.AsyncEventExecutionStep.InvokeEndHandler(IAsyncResult ar)
at System.Web.HttpApplication.AsyncEventExecutionStep.OnAsyncEventCompletion(IAsyncResult ar)
Nested Exception
Exception: System.AggregateException
Message: One or more errors occurred.
Source: mscorlib
at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions)
at System.Threading.Tasks.Task.Wait(Int32 millisecondsTimeout, CancellationToken cancellationToken)
at Microsoft.Owin.Security.Infrastructure.AuthenticationHandler.OnSendingHeaderCallback(Object state)
at Microsoft.Owin.Host.SystemWeb.CallHeaders.SendingHeadersEvent.Fire()
at Microsoft.Owin.Host.SystemWeb.OwinCallContext.StartOnce()
Nested Exception
Exception: System.NullReferenceException
Message: Object reference not set to an instance of an object.
Source: Sitecore.Owin.Authentication
at Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignIn.RemoveTicket.Process(SignInArgs args)
at (Object , Object )
at Sitecore.Pipelines.CorePipeline.Run(PipelineArgs args)
at Sitecore.Pipelines.DefaultCorePipelineManager.Run(String pipelineName, PipelineArgs args, String pipelineDomain, Boolean failIfNotExists)
at Sitecore.Pipelines.DefaultCorePipelineManager.Run(String pipelineName, PipelineArgs args, String pipelineDomain)
at Sitecore.Owin.Authentication.Security.Cookies.DefaultCookieAuthenticationProvider.ResponseSignIn(CookieResponseSignInContext context)
at Microsoft.Owin.Security.Cookies.CookieAuthenticationHandler.<ApplyResponseGrantAsync>d__13.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Owin.Security.Infrastructure.AuthenticationHandler.<ApplyResponseCoreAsync>d__40.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Owin.Security.Infrastructure.AuthenticationHandler.<ApplyResponseAsync>d__39.MoveNext()
The key part is this: Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignIn.RemoveTicket.Process(SignInArgs args). This is a pipeline which is only enabled when Sitecore Identity is enabled. Presumably the SSC auth endpoint does not utilise Sitecore Identity so what's going on here?
