1

We had sitecore local dev instance using /sitecore/login without using identityserver and we need to add the identity server back.

Here are steps I did in one VM and it worked fine:

  1. Get the https://identityserver.dev.local running and pointed to sitecore_core db for credentials and added https://xp0.dev.local as allowed url
  2. deleted 2 configuration patches that disabled the owin authentication
  3. modified sc.variable "identityServerAuthority" to https://identityserver.dev.local

but I copied the working folder identityserver.dev.local to company laptop with VPN, followed the same steps but when I tried to access the sitecore launchpad, it always direct to /sitecore/login .. I checked the network tab from browser and it went to

https://xp0.dev.local/identity/externallogin?authenticationType=SitecoreIdentityServer&ReturnUrl=%2fidentity%2fexternallogincallback%3fReturnUrl%3d%26sc_site%3dshell%26authenticationSource%3dDefault&sc_site=shell

The above POST found 302 and the found location on the working VM is the https://identityserver.dev.local/xxx but on the laptop the 302 is /sitecore/login?fbc=1

/sitecore/login?fbc=1 seems configured as true so for debug purpose I set it to false on both VM and laptop, in the working VM nothing has changed and continue working, but on laptop, I got the following error:

Unable to reach an external identity provider.

IDX20803: Unable to obtain configuration from: '[PII is hidden]'.

In the laptop that the login is not redirected to identity server, there is extra button at the bottom "Go to login" as shown below: enter image description here

Also I checked the showconfig.aspx on the VM that does not redirect correctly, the Owin.Authentication.Enabled and FederatedAuthentication.Enabled both True

It turned out that the problem was the system.runtime.compilerservices.unsafe.dll 5.0.0 in my bin folder and the expected version was 4.0.6. After copying the correct dll into the bin folder, I was able to see the login screen from identityserver.

after successfully authenticated I got another 500 error as shown below:

enter image description here

at top of right corner, I saw my name and a logout button - so the login was successful but I could not find any errors in logs.

Where should I look to troubleshoot further?

Improve this question
3
  • Please review the following url on both instances your-domain/sitecore/admin/showconfig.aspx and look for < sites > node. Then the one with site="shell". On that nose look for parameter loginPage. Do they look different? If so look to see what patch is making the change and add/remove it where necessary.
    – Dean OBrien
    Commented May 12 at 22:44
  • both of instance point to /identity/login/shell/SitecoreIdentityServer
    – John Lee
    Commented May 13 at 3:00
  • Its unlikely that you will see "sorry there was an error" on the CM and not find a corresponding error in one of the logs. Did you check Owin.log as well as the normal log file? If so, then please try switching the error level from "info" to "debug". Also, when you copied over the working folder of identity server, did you copy the relevant certificates and allow access to private keys etc?
    – Dean OBrien
    Commented May 13 at 14:08

1 Answer 1

Reset to default
3

It turned out that the last error was due to the application pool identity ApplicationPoolIdentity does not have some permissions in the web folder C:\inetpub\wwwroot\identityserver.dev.local.

The way I found out was I tried to enable stdoutLogEnabled by setting it to true in web.config of identityserver <aspNetCore processPath="dotnet" arguments=".\Sitecore.IdentityServer.Host.dll" stdoutLogEnabled="true" stdoutLogFile=".\logs\stdout" hostingModel="OutOfProcess" /> and in Windows event log I saw an entry Could not create stdoutLogFile C:\inetpub\wwwroot\identityserver.dev.local\logs\stdout_20240513132633_25968.log, ErrorCode = '0x80070005'.

After I change the pool identity to localsystem and everything works as expected.

Switch the pool identity back to ApplicationPoolIdentity and I got the error again as shown in the stdout log

[07:00:15] IdentityServer4.Hosting.IdentityServerMiddleware [Fatal] Unhandled exception: "Keyset does not exist"
Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: Keyset does not exist
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider, CngKeyOpenOptions openOptions)
   at System.Security.Cryptography.CngKey.Open(String keyName, CngProvider provider)
   at Internal.Cryptography.Pal.CertificatePal.GetPrivateKey[T](Func`2 createCsp, Func`2 createCng)
   at Internal.Cryptography.Pal.CertificatePal.GetRSAPrivateKey()
   at Internal.Cryptography.Pal.CertificateExtensionsCommon.GetPrivateKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints)
   at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPrivateKey(X509Certificate2 certificate)
   at Microsoft.IdentityModel.Tokens.X509SecurityKey.get_PrivateKey()
   at Microsoft.IdentityModel.Tokens.X509SecurityKey.get_PrivateKeyStatus()
   at Microsoft.IdentityModel.Tokens.AsymmetricSignatureProvider.FoundPrivateKey(SecurityKey key)
   at Microsoft.IdentityModel.Tokens.AsymmetricSignatureProvider..ctor(SecurityKey key, String algorithm, Boolean willCreateSignatures)
   at Microsoft.IdentityModel.Tokens.AsymmetricSignatureProvider..ctor(SecurityKey key, String algorithm, Boolean willCreateSignatures, CryptoProviderFactory cryptoProviderFactory)
   at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateSignatureProvider(SecurityKey key, String algorithm, Boolean willCreateSignatures)
   at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateForSigning(SecurityKey key, String algorithm)
   at Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities.CreateEncodedSignature(String input, SigningCredentials signingCredentials)
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.WriteToken(SecurityToken token)
   at IdentityServer4.Services.DefaultTokenCreationService.CreateJwtAsync(JwtSecurityToken jwt)
   at IdentityServer4.Services.DefaultTokenCreationService.CreateTokenAsync(Token token)
   at IdentityServer4.Services.DefaultTokenService.CreateSecurityTokenAsync(Token token)
   at IdentityServer4.ResponseHandling.AuthorizeResponseGenerator.CreateImplicitFlowResponseAsync(ValidatedAuthorizeRequest request, String authorizationCode)
   at IdentityServer4.ResponseHandling.AuthorizeResponseGenerator.CreateHybridFlowResponseAsync(ValidatedAuthorizeRequest request)
   at IdentityServer4.ResponseHandling.AuthorizeResponseGenerator.CreateResponseAsync(ValidatedAuthorizeRequest request)
   at IdentityServer4.Endpoints.AuthorizeEndpointBase.ProcessAuthorizeRequestAsync(NameValueCollection parameters, ClaimsPrincipal user, ConsentResponse consent)
   at IdentityServer4.Endpoints.AuthorizeCallbackEndpoint.ProcessAsync(HttpContext context)
   at IdentityServer4.Endpoints.AuthorizeCallbackEndpoint.ProcessAsync(HttpContext context)
   at IdentityServer4.Hosting.IdentityServerMiddleware.Invoke(HttpContext context, IEndpointRouter router, IUserSession session, IEventService events, IBackChannelLogoutService backChannelLogoutService)

This identity needs Full permission on the IIS web folder, it also need Read permission to read the private key of the certificate that is used to secure the https://identityserver.dev.local

Hope this help anyone who experienced the same. Happy troubleshooting!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.