1

I have created an API to get Sitecore user details, in a request it needs to pass the user ID and it will return user details which is working fine. I have deployed this API on CM. Also, there are some authentication tokens to validate, if the token is not correct then it will send the 401 status code but the problem is that when I pass the wrong authentication code it throws the below error and also sends a 500 error:

enter image description here

I have written below code:

 return Content(HttpStatusCode.Unauthorized, new Base { Detail = "Unauthorized", Status = "401" });

Please note this code I have deployed this on CM(Can not deploy on CD) and also using the Keycloak identity provider on CM.

This is a federation authentication code:

enter image description here

Thanks, Swati Gupta

1 Answer 1

1

This issue has been solved after I set AuthenticationMode as Passive.

AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive,

Below is a code:

 public class KeycloakIdentityProvider : IdentityProvidersProcessor   
   {   
    protected override string IdentityProviderName => "keycloak";   
    private string ClientId => Settings.GetSetting(KeycloakSettings.ClientId, "");   
    private string ClientSecret => Settings.GetSetting(KeycloakSettings.ClientSecret, "");   
    private string Authority => Settings.GetSetting(KeycloakSettings.Authority, "");   
    private string MetadataAddress => Settings.GetSetting(KeycloakSettings.MetadataAddress, "");   
    private string RedirectURL => Settings.GetSetting(KeycloakSettings.RedirectURL, "");   
    private readonly string OpenIdScope = OpenIdConnectScope.OpenIdProfile + " email";   
    private readonly string idToken = "id_token";   
    private readonly string accessDeniedRelativePath = "/custom/errorpages/Forbidden.aspx";   
    public KeycloakIdentityProvider(FederatedAuthenticationConfiguration federatedAuthenticationConfiguration, Microsoft.Owin.Infrastructure.ICookieManager cookieManager, BaseSettings settings) : base(federatedAuthenticationConfiguration, cookieManager, settings)   
    {   
    }   
    protected IdentityProvider IdentityProvider { get; set; }   
    protected override void ProcessCore(IdentityProvidersArgs args)   
    {   
     IdentityProvider = this.GetIdentityProvider();   
     var httphandler = new HttpClientHandler();   
     httphandler.DefaultProxyCredentials = CredentialCache.DefaultCredentials;   
     httphandler.CheckCertificateRevocationList = true;   
     httphandler.ServerCertificateCustomValidationCallback = (message, cert, chain, sslPolicyErrors) =>   
     {   
      return true;   
     };   
     var options = new OpenIdConnectAuthenticationOptions   
     {    
      AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive,
      BackchannelHttpHandler = httphandler,   
      //Backchannel = httpclient,   
      RequireHttpsMetadata = false,   
      MetadataAddress = MetadataAddress,   
      ClientId = ClientId,   
      ClientSecret = ClientSecret,   
      Authority = Authority,   
      RedirectUri = RedirectURL,   
      ResponseType = OpenIdConnectResponseType.Code,   
      Scope = OpenIdScope,   
      AuthenticationType = IdentityProvider.Name,   
      RedeemCode = true,   
      TokenValidationParameters = new TokenValidationParameters   
      {   
       NameClaimType = "name"   
      },   
      Notifications = new OpenIdConnectAuthenticationNotifications   
      {   
       RedirectToIdentityProvider = notification =>   
       {   
        if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication)   
        {   
         if (Sitecore.Context.User.IsAuthenticated)   
         {   
          notification.HandleResponse();   
          notification.Response.Redirect(Settings.GetSetting("Identity.sso.launchpad"));   
         }   
         else   
         {   
          notification.ProtocolMessage.SetParameter("kc_idp_hint", "saml");   
         }   
        }   
        if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)   
        {   
         // If signing out, add the id_token_hint   
         var idTokenClaim = notification.OwinContext.Authentication.User.FindFirst(idToken);   
         if (idTokenClaim != null)   
          notification.ProtocolMessage.IdTokenHint = idTokenClaim.Value;   
        }   
        return System.Threading.Tasks.Task.CompletedTask;   
       }   
      }   
     };   
     args.App.UseKentorOwinCookieSaver();   
     args.App.UseOpenIdConnectAuthentication(options);   
    }   
   }   

Complete detail is here https://swatiguptablogs.blogspot.com/2024/02/sitecore-custom-api-issue-with.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.