• Sitecore 10.3 XP
  • Sitecore Management Services
  • Headless 21
  • SXA 10.3
  • SPE 6.3
  • Federated Authentication via Okta

Problem Statement

Followed the steps to configure the Sitecore Identity and Content Management roles for a non-interactive login according to the Sitecore Documentation

Successfully executed a login with the cli:

dotnet sitecore login --cm https://cm.clientdomain.com  --authority https://si.clientdomain.com --client-id "SitecoreCLIServer" --client-secret "SuperSecret" --allow-write true --client-credentials true

The following commands all yield the same error:

  • dotnet sitecore ser pkg install -f .\content.itempackage
  • dotnet sitecore publish
  • dotnet sitecore ser pull

You are not authorized to perform the task you are attempting. You may need to be assigned additional permissions.  


  1. requiresUniqueEmail is false in the web.config
  2. External User Builder is the default
  3. Changed the password for the SitecoreCLIServer to a simple secret
  4. Attempted to login and install the content package with my interactive login which is an Administrator in Sitecore.
  5. CLI and Management Services share the same version, 5.2.113


Observed several 403 HTTP responses in Application Insights to the GraphQL Management API: POST Sitecore.Services.GraphQL.Hosting.Mvc.GraphQLController Sitecore.Services.GraphQL.NetFxHost/Query

The request above is always followed by these two exceptions:

Issuer name does not match authority: https://si.clientdomain.com
Exception: Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException
Message: IDX10501: Signature validation failed. Unable to match keys: 
kid: '[PII is hidden]', 
token: '[PII is hidden]'.
Source: System.IdentityModel.Tokens.Jwt
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)
   at Microsoft.Owin.Security.Jwt.JwtFormat.Unprotect(String protectedText) in /_/src/Microsoft.Owin.Security.Jwt/JwtFormat.cs:line 223
   at Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationHandler.<AuthenticateCoreAsync>d__3.MoveNext() in 
/_/src/Microsoft.Owin.Security.OAuth/OAuthBearerAuthenticationHandler.cs:line 56

1 Answer 1


This Sitecore instance was provisioned by Managed Cloud and still had the default identityServerAuthority variable defined using the domain assigned by Azure.

It looked something like this:

<sc.variable name="identityServerAuthority" value="https://mc-{{resource group identifier}}-si" />

When I patched this variable with an ContentManagement environment variable representing our custom domain, this issue was resolved:

<sc.variable role:require="Standalone or ContentManagement" name="identityServerAuthority" value="https://$(env:ID_HOST)" />

Here is how it's configured within Azure enter image description here

It's important to callout that this variable name is the same one used with a default docker setup, which preserves variable parity between local and higher environments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.