0

We are trying to setup Azure AD SSO integration for Sitecore 10.2 Instance,

  1. As an initial step., We can be able to see the Identity server page redirects when we browse /sitecore/login Screen: Azure Ad 400 Header Too Long_0.JPG

  2. We also did a setup from Azure AD tenant and its configuration for SSO login Screen: Azure Ad 400 Header Too Long_3.JPG

  3. When we trying to request Azure AD server, In Azure AD Group request and response is successful. But when we receive response in Sitecore end it shows below screen errors. *Screen: Azure Ad 400 Header Too Long_1.JPG Screen: Azure Ad 400 Header Too Long_2.JPG*

  4. We captured .Har for Reference. I guess here we can not attach. On reference: https://support.zendesk.com/hc/en-us/articles/204410413-Generating-a-HAR-file-for-troubleshooting Scree: Network

Note: We did verification in two Azure AD subscriptions,

  • Company account followed configuration like this - http://sitecore.gunasekaransengodan.com/sitecore-azure-active-directory-ad-sso
  • Client Specific Subscription: Same kind of configuration followed.
  • Company configuration with Tenant and client ID allows to login and redirects Launchpad.
  • Client specific Tenant and client ID fails with 400 - HTTP Error 400. The size of the request headers is too long.

Please advise for resolution, Is there a restriction to get the long cookie from Sitecore end? Or other issues.?.

We tried changing the size as suggested : https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1001329

Not luck on result. We also verified the Registry for MaxFieldLength and MaxRequestBytes. On Reference: [https://learn.microsoft.com/en-us/exchange/troubleshoot/client-connectivity/400-bad-request][9] [![Screen: Registry][10]][10]

Any experience similar or input will be appreciated.

Improve this question

1 Answer 1

Reset to default
0

This looks similar to the issue described here:

https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0522544

Recommendations from sitecore are as follows:

Solutions For Any Environment

  • Decrease the number of Azure AD security groups some of your users are in (the limit for the cookies is around 32KB).
  • Change some of your security groups into application roles: https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps Note: When mapping claims for application roles you should use the claim "roles" instead of "groups" in your configuration.
  • Write your own module plugin for integrating Azure AD in the Sitecore Identity Server to filter out unnecessary security groups.
Improve this answer
6
  • Thank you Dean Obrien for the suggestion link, Yes, we tried changing the MaxFieldLength and MaxRequestBytes by referring learn.microsoft.com/en-us/exchange/troubleshoot/…. Will also check group as per as we know and created one group and assigned the user details i used for login. Let me double check other than group folder any other link to maximize the cookie size high.
    – Gunasekaran
    Commented Dec 9, 2022 at 12:52
  • The solution for me is added below in Identity Server Web.config '<system.web> <httpRuntime maxRequestLength="2097151" /> </system.web>'
    – Gunasekaran
    Commented Dec 22, 2022 at 9:22
  • Here is the other scenario of error : Same setup followed in server Which is secured environment consider it. The call redirects back to default login than identity server login with Azure AD button enabled. Authorize call not happens - NS_BINDING_REDIRECTED is 'Transferred' column status of Network tab when trying to check in Firefox. any idea?
    – Gunasekaran
    Commented Dec 22, 2022 at 9:34
  • Gunasekaran - glad you solved the original issue. Strange that solution was maxRequestLength as you mention in question that you already tried this. As it is suggested in the article you link and also the one I linked too.
    – Dean OBrien
    Commented Dec 22, 2022 at 13:08
  • With regards the second scenario - It is good practice to create a second question specific to those circumstances, so that it might be useful to someone else in the future.
    – Dean OBrien
    Commented Dec 22, 2022 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.