1

We have integrated OnPrem ADFS for authentication with OnPrem Sitecore setup. ADFS is used to authenticate both sitecore CM and CD. We have allowed some of the pages for anonymous user(from Security Access Viewer) so those could be accessed with out login from CD. Recently On one of the environments we are facing an issue on sitecore CD where user is redirecting to login page when accessing the anonymous pages. We could not find the root cause and there are no recent changes that could cause this issue.

Anyone faced a similar issue or could provide any help to find the root cause would be great help.

Sitecore version 9.3

2 Answers 2

0

I had a similar setup as you decribe, whereby ADFS was used to control access to the CD environment.

Assuming you followed the same approach, by creating a new domain and adding that to the sites node.

If so, there are some setting there that could cause the issue you are describing. Please review your config (App_Config/Security/Domains.config) and specifically these settings:

anonymousUserName: The name of the anonymous user for the domain (without the domain name). Set to blank to disable the anonymous user for the domain. Optional - default value: Anonymous

ensureAnonymousUser: Indicates if the domain should ensure that an anonymous user for the domain exists in the Membership database. Optional - default value: false

everyoneRoleName: The name of the everyone role for the domain (without the domain name). Set to blank to disable the everyone role for the domain. Optional - default value: Everyone

Im guessing you may have set anonymousUserName and everyoneRoleName to blank?

Some further info here: https://deanobrien.uk/sitecore-identity-server-mapping-custom-fields-and-roles-from-azure-ad/

3
  • Thanks Dean for the explanation. But we do not have any entry for the 3 settings, hence they should be the default values. Let me know, if you can provide any more information or suggestions
    – D J
    Commented Jan 12, 2023 at 9:59
  • Can you confirm that annonymous user has access to the same pages on other environments? Is domains.config same on all? Commented Jan 12, 2023 at 10:44
  • Yes, domains.config is same across the environments
    – D J
    Commented Jan 12, 2023 at 12:51
0

In addition to Dean's answer, you can also try checking permissions for the page that should be available to anonymous users.

To do this, go to the Launchpad → Access Viewer, then select your anonymous user for the website (by default it is extranet\Anonymous but can also be a custom domain if you configured it). After this, find your page in the tree and select the Read permission.

On the right hand site there will be a block explaining why the specified account can or can't read this page:

Access Viewer

If the anonymous user does not have read access to the page, then Sitecore will redirect anonymous users to the login page automatically (assuming that you have the loginPage specified in the <site> config).

Depending on how permissions were set for the pages, it is possible that some security rules have changed on the page itself or its parent items so it's worth double checking that the security permissions are still correct.

If permissions are correct, you can also check if there are any custom processors in the <httpRequestBegin> pipeline that can override the standard item resolving logic and trigger a redirect to the login page.

9
  • Thanks Anna for the detailed explanation. I have tried providing access to extranet\Anonymous and customDomain\Anonymous and still getting redirected to Login page. I have verified that there are no such pipeline, which could cause such a behavior.
    – D J
    Commented Jan 12, 2023 at 12:50
  • Thanks @DeepakJena, please make sure that your publish items after updating security permissions on them. If it still does not work as expected, please show us a screenshot of Access Viewer for your anonymous user
    – Anna Gevel
    Commented Jan 12, 2023 at 13:19
  • Thanks Anna, I have published the items post security update and verified on Web DB as well. Here is a screenshot of the Access Viewer snipboard.io/MQXih8.jpg
    – D J
    Commented Jan 12, 2023 at 14:22
  • And Everyone Role has access to Sitecore root node
    – D J
    Commented Jan 12, 2023 at 14:25
  • @DeepakJena ah, looks like this screenshot is from the Security Editor. Please could you make a similar screenshot but in the Access Viewer? Access Viewer will show the final result after combining all the permissions from this item and its parent items. Potentially there is a "deny" rule somewhere and it overrides all "allow" rules.
    – Anna Gevel
    Commented Jan 12, 2023 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.