Sitecore CD Pages with anonymous rights are redirecting to login page

Question

We have integrated OnPrem ADFS for authentication with OnPrem Sitecore setup. ADFS is used to authenticate both sitecore CM and CD. We have allowed some of the pages for anonymous user(from Security Access Viewer) so those could be accessed with out login from CD. Recently On one of the environments we are facing an issue on sitecore CD where user is redirecting to login page when accessing the anonymous pages. We could not find the root cause and there are no recent changes that could cause this issue.

Anyone faced a similar issue or could provide any help to find the root cause would be great help.

Sitecore version 9.3

Answer 1

I had a similar setup as you decribe, whereby ADFS was used to control access to the CD environment.

Assuming you followed the same approach, by creating a new domain and adding that to the sites node.

If so, there are some setting there that could cause the issue you are describing. Please review your config (App_Config/Security/Domains.config) and specifically these settings:

anonymousUserName: The name of the anonymous user for the domain (without the domain name). Set to blank to disable the anonymous user for the domain. Optional - default value: Anonymous

ensureAnonymousUser: Indicates if the domain should ensure that an anonymous user for the domain exists in the Membership database. Optional - default value: false

everyoneRoleName: The name of the everyone role for the domain (without the domain name). Set to blank to disable the everyone role for the domain. Optional - default value: Everyone

Im guessing you may have set anonymousUserName and everyoneRoleName to blank?

Some further info here: https://deanobrien.uk/sitecore-identity-server-mapping-custom-fields-and-roles-from-azure-ad/

Answer 2

In addition to Dean's answer, you can also try checking permissions for the page that should be available to anonymous users.

To do this, go to the Launchpad → Access Viewer, then select your anonymous user for the website (by default it is extranet\Anonymous but can also be a custom domain if you configured it). After this, find your page in the tree and select the Read permission.

On the right hand site there will be a block explaining why the specified account can or can't read this page:

If the anonymous user does not have read access to the page, then Sitecore will redirect anonymous users to the login page automatically (assuming that you have the loginPage specified in the <site> config).

Depending on how permissions were set for the pages, it is possible that some security rules have changed on the page itself or its parent items so it's worth double checking that the security permissions are still correct.

If permissions are correct, you can also check if there are any custom processors in the <httpRequestBegin> pipeline that can override the standard item resolving logic and trigger a redirect to the login page.