2

I have installed Sitecore 10.2 XM in my local machine. It's installed 3 sites (CM, CD and IdentityServer).

When I access the IdentityServer URL https://test.identityserver.localhost/ it works fine. I am able to login and logout without any issues.

When I access the CM URL https://test.cm.localhost/sitecore/login I am expecting this should redirect me to IdentityServer site and after successful login redirect me to CM site. But this is not happening and when I access the CM URL https://test.cm.localhost/sitecore/login it is going to https://test.cm.localhost/sitecore/login?fbc=1 I am able to login successful though. But I expect it should go to IdentityServer site when I login/logout.

In the file, C:\inetpub\wwwroot\IDS\test.cm.localhost\App_Config\Sitecore\Owin.Authentication.IdentityServer\Sitecore.Owin.Authentication.IdentityServer.config, I have the following setting:

<sc.variable name="identityServerAuthority" value="https://test.identityserver.localhost" />

Below is my IdentityServer config file C:\inetpub\wwwroot\IDS\test.identityserver.localhost\Config\production\Sitecore.IdentityServer.Host.xml

<?xml version="1.0" encoding="utf-8" ?>
<Settings>
<Sitecore>
<IdentityServer>
  <CertificateThumbprint>8C0635270629989F235AD625692FC9220F0C1400</CertificateThumbprint>
  <CertificateStoreLocation>LocalMachine</CertificateStoreLocation>
  <CertificateStoreName>My</CertificateStoreName>
  <SitecoreMembershipOptions>
    <ConnectionString>Data Source=XXXXXX;Initial Catalog=Test_Core;User ID=securityuser;Password=ZPOgVcB1jMWadVFP0R6K</ConnectionString>
  </SitecoreMembershipOptions>
  <AccountOptions>
    <PasswordRecoveryUrl>https://test.cm.localhost/sitecore/login?rc=1</PasswordRecoveryUrl>
  </AccountOptions>
  <Clients>
    <DefaultClient>
      <AllowedCorsOrigins>
        <AllowedCorsOriginsGroup1>https://test.cm.localhost</AllowedCorsOriginsGroup1>
      </AllowedCorsOrigins>
    </DefaultClient>
    <PasswordClient>
      <ClientSecrets>
        <ClientSecret1>IdentityServerClientSecret</ClientSecret1>
      </ClientSecrets>
    </PasswordClient>
  </Clients>
</IdentityServer>

I have the below entry in my CM site connectionstrings.config file as well:

<add name="sitecoreidentity.secret" connectionString="IdentityServerClientSecret" />
3
  • You don't have Sitecore.Owin.Authentication.IdentityServer.Disabler.config on your CM, do you?
    – Marek Musielak
    Jun 7, 2022 at 9:45
  • @MarekMusielak - I don't have that in my CM site folder
    – Jey
    Jun 7, 2022 at 9:48
  • Is it by default not redirecting or it has custom config anything Like Azure AD etc.? Nov 2, 2022 at 4:28

7 Answers 7

4

Please follow the below steps:

  1. Go to the certificates -> personal certificates
  2. Right-click on the identity server certificate
  3. Click on All Tasks -> Manage Private Keys
  4. Check if the identity app pool has permission on the identity certificate or not, it must have permission.

enter image description here

3
  • I have added the App Pool in the certificate and provided full control. It's not solving the issue. It's going to CM login only not redirecting to IdentityServer login
    – Jey
    Jun 7, 2022 at 9:46
  • Can you check the log file of the identity server? Jun 7, 2022 at 10:03
  • 1
    There is no error in "identityserver" log. But in CM log, there is an error ERROR Unable to reach an external identity provider. Exception: System.InvalidOperationException Message: IDX20803: Unable to obtain configuration from: '[PII is hidden]'. Source: Microsoft.IdentityModel.Protocols
    – Jey
    Jun 7, 2022 at 10:39
1

In my case answer is : Telerik configuration Impacted. Make sure the configuration in web.config is right or comment it to validate if used in web.config.

0

I am not entirely sure if this may help. But, I had a similar issue once before, and below is this solution that worked for me:

Go to the webroot of your Identity Server instance, and then go to the sitecoreruntime folder.

Here, replace the license.xml file with the one you have for your CM instance.

Do an iisreset, and check if this resolves your issue.

Hope this works for you!

1
  • I have replaced the license.xml file . But no luck still. Thanks Vinay
    – Jey
    Jun 7, 2022 at 10:36
0

I think, first, you need to verify into your CM site webroot by going to the config

\App_Config\Sitecore\Owin.Authentication.IdentityServer\Sitecore.Owin.Authentication.IdentityServer.config

and check if it's set with the proper identityserver site value or not like below.

<sc.variable name="identityServerAuthority" value="https://youtsiteidentityserver.dev.local" />

Then you need to go to your identityserver site webroot and go to the config

\Config\production\Sitecore.IdentityServer.Host.xml

and verify that the following is set properly with your CM site or not.

<AllowedCorsOrigins>
      <AllowedCorsOriginsGroup1>https://yourcmsite.dev.local</AllowedCorsOriginsGroup1>
</AllowedCorsOrigins>

Hope it should work.

7
  • Hi @Sumit Bhatia, I have them in my config files as i provided in the question
    – Jey
    Jun 7, 2022 at 11:00
  • Hi @user1428019 Did you check that you have the identity site entry in the host file? Jun 7, 2022 at 11:07
  • Yes. It is there. I am able to hit the identity server URL test.identityserver.localhost and it's working fine in login and logout. when i login into CM, it's not taking me to Identity server site to login and on login success i want to land back to CM.
    – Jey
    Jun 7, 2022 at 11:22
  • @user1428019 I think this is the only configuration where we set the identity server URL where the site redirects to login. One more place I would like you to check in the Web.Config and check this key look like this <add key="security:define" value="Sitecore" /> Jun 7, 2022 at 11:32
  • <add key="security:define" value="Sitecore" /> <add key="owin:appStartup" value="Sitecore.Owin.Startup, Sitecore.Owin" /> I have those keys
    – Jey
    Jun 7, 2022 at 11:37
0

Thank you all for your help. Issue was i had the different SAN/DNS in my Identity server SSL certificate and in IIS. when i have both of them in sync it works like charm.

5
  • HI @Jey Did you mean that in IIS you have selected a different SSL for your identity server? Jul 28, 2022 at 10:59
  • In case my issue was i had the SSL cert issue. I had a different DNS name in my cert between the Binding Name.
    – Jey
    Jul 29, 2022 at 11:19
  • Thanks but how do you update it? Is there any command? Jul 29, 2022 at 11:44
  • There is a key tool command to generate the certificate. Just ensure the binding name matches the DNS name in the certificate
    – Jey
    Jul 31, 2022 at 19:46
  • When you install the OOTB sites Sitecore does the same. Please let me know if you are running into the IDS redirect issue still.
    – Jey
    Jul 31, 2022 at 19:46
0

I faced the same issue and found below link is very helpful:

https://www.getfishtank.com/blog/unable-to-login-to-sitecore-10-via-the-identity-server

To find out the exact issue we should run the following cmd command in the administrator mode:

Go to c:\inetpub\wwwroot\xxxidentityserver.dev.local

Run the below command to see the exact issue:

dotnet .\Sitecore.IdentityServer.Host.dll

In case of not having any issue, you see screen similar to this:

enter image description here

0

For me After configuring Azure AD login, my CM url not redirected to SI server.

  • Issue was below two files present in CM under wwwroot\App_Config\Environment>

Removed and it's started working

-Sitecore.Owin.Authentication.Disabler
-Sitecore.Owin.Authentication.IdentityServer.Disabler

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.