Add IdentityServer back to Sitecore 10.1.2

Question

We had sitecore local dev instance using /sitecore/login without using identityserver and we need to add the identity server back.

Here are steps I did in one VM and it worked fine:

1. Get the https://identityserver.dev.local running and pointed to sitecore_core db for credentials and added https://xp0.dev.local as allowed url
2. deleted 2 configuration patches that disabled the owin authentication
3. modified sc.variable "identityServerAuthority" to https://identityserver.dev.local

but I copied the working folder identityserver.dev.local to company laptop with VPN, followed the same steps but when I tried to access the sitecore launchpad, it always direct to /sitecore/login .. I checked the network tab from browser and it went to

https://xp0.dev.local/identity/externallogin?authenticationType=SitecoreIdentityServer&ReturnUrl=%2fidentity%2fexternallogincallback%3fReturnUrl%3d%26sc_site%3dshell%26authenticationSource%3dDefault&sc_site=shell

The above POST found 302 and the found location on the working VM is the https://identityserver.dev.local/xxx but on the laptop the 302 is /sitecore/login?fbc=1

/sitecore/login?fbc=1 seems configured as true so for debug purpose I set it to false on both VM and laptop, in the working VM nothing has changed and continue working, but on laptop, I got the following error:

Unable to reach an external identity provider.

IDX20803: Unable to obtain configuration from: '[PII is hidden]'.

In the laptop that the login is not redirected to identity server, there is extra button at the bottom "Go to login" as shown below:

Also I checked the showconfig.aspx on the VM that does not redirect correctly, the Owin.Authentication.Enabled and FederatedAuthentication.Enabled both True

It turned out that the problem was the system.runtime.compilerservices.unsafe.dll 5.0.0 in my bin folder and the expected version was 4.0.6. After copying the correct dll into the bin folder, I was able to see the login screen from identityserver.

after successfully authenticated I got another 500 error as shown below:

at top of right corner, I saw my name and a logout button - so the login was successful but I could not find any errors in logs.

Where should I look to troubleshoot further?

Answer 1

It turned out that the last error was due to the application pool identity ApplicationPoolIdentity does not have some permissions in the web folder C:\inetpub\wwwroot\identityserver.dev.local.

The way I found out was I tried to enable stdoutLogEnabled by setting it to true in web.config of identityserver <aspNetCore processPath="dotnet" arguments=".\Sitecore.IdentityServer.Host.dll" stdoutLogEnabled="true" stdoutLogFile=".\logs\stdout" hostingModel="OutOfProcess" /> and in Windows event log I saw an entry Could not create stdoutLogFile C:\inetpub\wwwroot\identityserver.dev.local\logs\stdout_20240513132633_25968.log, ErrorCode = '0x80070005'.

After I change the pool identity to localsystem and everything works as expected.

Switch the pool identity back to ApplicationPoolIdentity and I got the error again as shown in the stdout log

[07:00:15] IdentityServer4.Hosting.IdentityServerMiddleware [Fatal] Unhandled exception: "Keyset does not exist"
Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider)
   at Internal.Cryptography.Pal.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at Internal.Cryptography.Pal.CertificatePal.GetRSAPrivateKey()
   at Internal.Cryptography.Pal.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at Microsoft.IdentityModel.Tokens.X509SecurityKey.get_PrivateKey()
   at Microsoft.IdentityModel.Tokens.X509SecurityKey.get_PrivateKeyStatus()
   at Microsoft.IdentityModel.Tokens.AsymmetricSignatureProvider.FoundPrivateKey(SecurityKey key)
   at Microsoft.IdentityModel.Tokens.AsymmetricSignatureProvider..ctor(SecurityKey key, String algorithm, Boolean willCreateSignatures)
   at Microsoft.IdentityModel.Tokens.AsymmetricSignatureProvider..ctor(SecurityKey key, String algorithm, Boolean willCreateSignatures, CryptoProviderFactory cryptoProviderFactory)
   at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateSignatureProvider(SecurityKey key, String algorithm, Boolean willCreateSignatures)
   at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateForSigning(SecurityKey key, String algorithm)
   at Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities.CreateEncodedSignature(String input, SigningCredentials signingCredentials)
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.WriteToken(SecurityToken token)
   at IdentityServer4.Services.DefaultTokenCreationService.CreateJwtAsync(JwtSecurityToken jwt)
   at IdentityServer4.Services.DefaultTokenCreationService.CreateTokenAsync(Token token)
   at IdentityServer4.Services.DefaultTokenService.CreateSecurityTokenAsync(Token token)
   at IdentityServer4.ResponseHandling.AuthorizeResponseGenerator.CreateImplicitFlowResponseAsync(ValidatedAuthorizeRequest request, String authorizationCode)
   at IdentityServer4.ResponseHandling.AuthorizeResponseGenerator.CreateHybridFlowResponseAsync(ValidatedAuthorizeRequest request)
   at IdentityServer4.ResponseHandling.AuthorizeResponseGenerator.CreateResponseAsync(ValidatedAuthorizeRequest request)
   at IdentityServer4.Endpoints.AuthorizeEndpointBase.ProcessAuthorizeRequestAsync(NameValueCollection parameters, ClaimsPrincipal user, ConsentResponse consent)
   at IdentityServer4.Endpoints.AuthorizeCallbackEndpoint.ProcessAsync(HttpContext context)
   at IdentityServer4.Endpoints.AuthorizeCallbackEndpoint.ProcessAsync(HttpContext context)
   at IdentityServer4.Hosting.IdentityServerMiddleware.Invoke(HttpContext context, IEndpointRouter router, IUserSession session, IEventService events, IBackChannelLogoutService backChannelLogoutService)

This identity needs Full permission on the IIS web folder, it also need Read permission to read the private key of the certificate that is used to secure the https://identityserver.dev.local

Hope this help anyone who experienced the same. Happy troubleshooting!