2

We have recently upgraded one of our Sitecore XP Instances from 9.3 to 10.3.

In our instance, we have one front end site, which has requireLogin="true" and loginPage="$(loginPath)oursite/SitecoreIdentityServer/IdS4-WsFederation" configured on the site node. This normally results in any visitors to the front end being redirected first to Identity Server, then to our on Premise ADFS.

This process worked fine pre upgrade (in XP 9.3). It also continues to work fine when visiting the front end on our CM instance post upgrade (in XP 10.3). However, now on our CD instance, when we try to access the front end, we are immediately redirected to a 401 page. Sequence below:

  1. site-root/
  2. site-root/identity/login/digitalportal/SitecoreIdentityServer/IdS4-WsFederation?returnUrl=%2f
  3. site-root/identity/externallogin?authenticationType=SitecoreIdentityServer&ReturnUrl=%2fidentity%2fexternallogincallback%3fReturnUrl%3d%252f%26sc_site%3ddigitalportal%26authenticationSource%3dDefault&sc_site=digitalportal&idp=IdS4-WsFederation

The failure appears to be prior to any connection to identity server (no logs present their). Their are no exceptions showing in the sitecore logs either.


Troubleshooting

I have tried a variety of things trying to compare why the CM works and the CD doesnt (switching bin/app_config/web.config etc over CM instance).

I have found that if I update the CD instance to have key="role:define" value="ContentManagement" in the web.config (and copy over CM connection strings), the login works fine. If I switch back to 'ContentDelivery' if fails again.

So that one single update (all other config left exactly the same) is enough to reproduce the issue.

This would suggest to me that the issue is down to some role based config files. However we only have one custom config that is "CD only" which deals with private session. We have a larger number of "CM only" files, but these are stripped out during the deployment of the CD instance. So these can have no bearing (as shown above CM works ok without them).

There would obviously be a large number of OTB sitecore config files that are CD Only, but we have not has a problem in XP 9.3.


Other considerations

The upgrade to 10.3 led us to switch to using the Duende Identity server. We are using that plus a plugin originally based on this from George Chang to link through to On Prem ADFS. However, as I mention I dont believe it is getting as far as ID server.

When the CM successfully logs in, it follows the exact same sequence of redirects above. But then moves from (3) to (4)

 mysite-root/connect/authorize?client_id=Sitecore&response_type=code%20id_token%20token&scope=openid%20sitecore.profile&state=OpenIdConnect.AuthenticationProperties%3DdYz2TBvb7nQDCicsKGtxp7jeGnKMlNPakSY0tUwH--6tSfSfr9slzjVb4MSycHMDUZkOjxwIz809gW4wb-Sm8sxfg8lkeDfjEsPodMlgL7RrRK38CWbjJOg9-ifQumQHhKgbFtRZEmRd0IL_mqwry0H3Fpm2V4QNdfvqXLaXOmyv0dozrtyOWbL9yIgsPiMjNAM-0DRDc9BMmuirdEfObfRqOKv02x0xVwQr51gYDMjd0DowrX_Hfrz9ya5QO2IVVv3Rk3HlfNDSCytiKw8E0A&response_mode=form_post&nonce=638386701886505118.MzEwOWNlOTUtNzRlOC00MjhlLThmODktODM1MTJiNzY2MGJmYTM0ODBlYjMtNWQ5Yy00ZmNlLWIxZWEtODJhYzMyYmQ5OGI2&acr_values=idp%3AIdS4-WsFederation&redirect_uri=https%3A%2F%2Fmysite%2Fidentity%2Fsignin&sc_account_prefix=azure%5C&x-client-SKU=ID_NET461&x-client-ver=5.3.0.0

Finally, whilst the resulting page after the failed login shows a HTTP ERROR 401. The corresponding network trace in the console shows HTTP_RESPONSE_CODE_FAILURE (please see attached image).enter image description here

1 Answer 1

2

This may be a long shot, but please try checking the standard Sitecore config file \App_Config\Sitecore\Owin.Authentication.IdentityServer\Sitecore.Owin.Authentication.IdentityServer.config.

This config enables the identity provider and pipelines responsible for Identity Server integration. In version 9.3 this config is applicable to CM, CD and Standalone roles:

<sitecore role:require="Standalone or ContentDelivery or ContentManagement">

Starting from version 10 this has changed and now this config is only enabled for CM and Standalone instances:

<sitecore role:require="Standalone or ContentManagement">

So please try checking this file and if it's the problem, you will need to create a config patch enabling Identity Server integration for your CD role.

1
  • 1
    Thanks Anna, that is indeed the issue - great spot. cheers Dec 21, 2023 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.