Sitecore CLI Not Authorized to perform the task you are attempting: No Sitecore CLI User Created

Question

I have 3 Sitecore environments that have the same configs required for non-interactive login with the Sitecore CLI. 2 of the 3 work without issue, but the 3rd is not. despite having the same configuration files per: https://doc.sitecore.com/xp/en/developers/102/developer-tools/configure-a-non-interactive-client-login.html

I checked that requiresUniqueEmail is false in the web.config, and all files are the same across environments (except for values that should be different like the URLs of the ID Service, CMS, and CliServerClient).

I just don't see the CLI User getting created in the CMS as a User like the other environments. I am wondering if I am missing a step in how this user account gets created as I thought this would create it:

dotnet sitecore login --authority https://<sitecore-identity-server> --cm http://<sitecore-instance> --allow-write true --client-credentials true --client-id <client-id> --client-secret <client-secret>

When I run this, it reports:

Login information has been saved.

The error I receive when I try to run something such as a "dotnet sitecore ser push" is as follows:

You are not authorized to perform the task you are attempting. You may need to be assigned additional permissions.

What am I missing to get the Sitecore CLI user created in the CMS?

UPDATE: In the Logs, I am receiving the following. We do have SHA512 enabled but the other 2 environments had them as well before the user was created.

1064 17:53:06 ERROR [Sitecore Identity] 'http://www.sitecore.net/identity/claims/originalIssuer' claim is missing
2820 17:53:06 ERROR Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationMiddleware - Authentication failed
Exception: System.InvalidOperationException
Message: Unable to create a user. Reason: InvalidPassword
Source: Sitecore.Owin.Authentication
   at Sitecore.Owin.Authentication.Identity.MembershipUserStore`1.CreateAsync(TUser user)
   at Microsoft.AspNet.Identity.UserManager`2.<CreateAsync>d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Sitecore.Owin.Authentication.Services.DefaultApplicationUserResolver.<ResolveApplicationUserAsync>d__18.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Sitecore.Owin.Authentication.Pipelines.Initialize.BearerAuthenticationBase.<ResolveUser>d__34.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Sitecore.Owin.Authentication.Pipelines.Initialize.BearerAuthenticationBase.<ValidateIdentity>d__31.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationHandler.<AuthenticateCoreAsync>d__3.MoveNext()

Answer 1

Thanks for everyones assistance. After working here, in Sitecore Slack, and with Sitecore Support... it was discovered that the SqlMembershipProvider.GeneratePassword Method is not "guaranteed to pass the regular expression in the PasswordStrengthRegularExpression property" - https://learn.microsoft.com/en-us/dotnet/api/system.web.security.sqlmembershipprovider.generatepassword?view=netframework-4.8

Once we removed that setting, the CLI User is getting created.

I blogged the full details here: https://thebitsthatbyte.com/sitecore-cli-non-interactive-user-not-created/

Answer 2

Try out the below approaches and see if it works for you.

1. Delete user.json file and run the command securely by passing --authority and --cm with https://.

dotnet sitecore login --authority https://<sitecore identity server> --cm https://<sitecore instance> --allow-write true --client-credentials true --client-id <client id> --client-secret <client secret>

OR

Bypass the https protocol restriction with --insecure.

dotnet sitecore login --cm https://<sitecore instance> --auth http://<sitecore identity server> --allow-write true --client-id <client id> --client-secret <client secret> --client-credentials true --insecure

Reference: Examples of using the login command for noninteractive user login

2. You can make sure that the user is created with a valid emailaddress, by changing the Sitecore.Owin.Authentication.ClientCredentialsMapping.config from step 8 in the documentation. set requiresUniqueEmail to true within the SQL Membership provider in your web.config

    <membership defaultProvider="sitecore" hashAlgorithmType="SHA1">
      <providers>
        <clear />
        <add name="sitecore" type="Sitecore.Security.SitecoreMembershipProvider, Sitecore.Kernel" realProviderName="sql" providerWildcard="%" raiseEvents="true" />
        <add name="sql" type="System.Web.Security.SqlMembershipProvider" connectionStringName="security" applicationName="sitecore" minRequiredPasswordLength="1" minRequiredNonalphanumericCharacters="0" requiresQuestionAndAnswer="false" requiresUniqueEmail="true" maxInvalidPasswordAttempts="5" />
        <add name="disabled" type="Sitecore.Security.DisabledMembersipProvider, Sitecore.Kernel" applicationName="sitecore" />
        <add name="switcher" type="Sitecore.Security.SwitchingMembershipProvider, Sitecore.Kernel" applicationName="sitecore" mappings="switchingProviders/membership" />
      </providers>
    </membership>

Update

These are a few points you can validate to fix/troubleshoot the issue.

1. Check if the Identity server running well.

2. Validate your Sitecore Identity server configuration one more time to ensure all the configuration sync with your other 2 instances.

3. Check the identity server license is not expired.

4. Recycle the Sitecore Identity Server application pool. Sometimes such wired issue gets resolved by recycling the application pool.

5. Change the hash algorithm for password encryption here.

Hope it helps!