9
votes
Accepted
Unsuccessful login with external provider
I finally managed to get both Sitecore login (standard) and enduser login (Azure B2C AD) to work at the same time. I did a few changes and I am not 100% sure exactly which of them made the difference, ...
- 884
6
votes
Accepted
How can I get SXA login working with my Federated Authentication via IdentityServer?
So after some back and forth with Sitecore Support, this is the conclusion and the solution.
The fact that SXA ends up in the endless loop has been registered as a bug. Bug reference number #349107.
...
- 25.4k
6
votes
Accepted
Azure AD user not showing assigned roles/profile in user manager
I heard from Sitecore support on the roles at least, so I wanted to share this answer:
The concept of the Federated Authentication means that you delegate
authentication to a trusted identity ...
- 5,132
6
votes
Accepted
Is Virtual user concept available in XM version?
Yes, you can use virtual users in XM:
Sitecore also supports Virtual Users, which is a transient user account system that you can use, for example, when integrating with custom authentication ...
- 6,821
5
votes
Accepted
Sitecore 9.1 IdentityServer AzureAD subprovider user cannot login to the Admin site
https://sitecore.derekc.net/setting-up-azure-active-directory-integration-with-sitecore-identity-server-sitecore-9-1/ might have your solution -- he writes:
"just 'cuz you're in AD, doesn't mean ...
- 1,309
5
votes
OWIN sign-in links only working for SXA sites NOT configured in MapEntry of IdentityProvidersPerSite
There a few reasons why you are facing these issues:
You are using the [Authorize] Attribute
You are doing an own mapping
Sitecore, Identity & Owin do work a little bit different that you
would ...
- 1,867
5
votes
Mapping property in Sitecore 9 federated authentication
You are using invalid claim names in your configuration.
You should use it this way:
<map name="email claim" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore....
- 9,541
5
votes
Accepted
Stuck in redirect loop after external signout with Federated Authentication
If you don't want to signout of B2C when the user logs out of Sitecore, just set TriggerExternalSignOut to false in your identity provider configuration.
The external redirect feature appears to be ...
- 251
5
votes
Accepted
Where is Sitecore.Owin.Authentication.Enabler.config in Sitecore 9.1?
Sitecore 9.1.0 and later enabled the Federated authentication entries by default that's why we are seeing the .\Website\App_Config\Include\Examples\Sitecore.Owin.Authentication.Disabler.config.example ...
- 1,976
5
votes
Accepted
PostLogoutRedirectUri with Owin and Azure ADb2C
Probably might help someone. I managed to figure this out as the issue was on the Controller Action for SignOut.
Sitecore handles the Owin Middleware integration little differently from Asp.NET. ...
- 1,655
5
votes
Accepted
Does Sitecore 10.0.1 support SAML with Okta?
Yes, you can have a SAML Federated Authentication implementation with Sitecore 10.0.1. Federated Auth is a bring-your-own-auth framework, and while most examples show OpenID Connect, you can implement ...
- 251
4
votes
Accepted
Could not find configuration node: federatedAuthentication/sharedTransformations/setIdpClaim
I gone through into the greater details of the issue and found the solution.
I replaced the configuration for Idp Claim transformation from
<transformation name="Idp Claim" ref="...
- 2,933
4
votes
Mapping property in Sitecore 9 federated authentication
I implemented a custom user builder by inheriting from ExternalUserBuilder where i override the CreateUniqueUserName method to provide the email as username and now the user created is having username ...
- 749
4
votes
Accepted
Federated Authentication with ExternalCookie
Treat it as a comment. I don't have enough reputation to make a real one.
Have you specified allowed sites for your external identity provider in the corresponding federatedAuthentication/...
4
votes
Accepted
Sitecore Logged In Pipeline in Identity Server?
I've figured out the answer based on the comment from @Gobinath and answer of this thread.
So, first you must add NEW config for these Owin and IdentityServer stuffs and don't touch your previous ...
- 367
4
votes
Accepted
How can I update Virtual User's role after authenticating via external Identity Provider (Azure)?
Response from Sitecore Support suggests that it is not possible to manipulate the Sitecore Virtual User roles or profile when using Federated Authentication. I have been advised that:
This is ...
4
votes
Login with multiple Identity Providers at the same time
using different domains for front- and backend is the most simple one. Cookies won't be shared between those domains.
- 1,867
3
votes
Sitecore redirecting to federated authentication provider on unauthorized
You can set the NoAccessUrl setting or the loginPage attribute on the sitedefinition to point to your custom page. This article has an example of using the NoAccessUrl to point to a custom page.
- 1,224
3
votes
Accepted
Getting an instance of BaseCorePipelineManager
Your code is correct. Just add Microsoft.Extensions.DependencyInjectionnamespace. It contains ServiceProviderServiceExtensions extension class that adds generic methods to the IServiceProvider ...
3
votes
Accepted
Uncaught SyntaxEditor: Unexpected token Error while accessing Experience Editor using Federated Authentication
Sitecore Support provided a solution for this. Basically it was to swap the position of two pipeline calls in the owin.cookieAuthentication.validateIdentity pipeline. I've put this patch into my ...
- 5,132
3
votes
Accepted
Facebook / Google login for website with Federated Authentication
The Habitat v9 branch has a working example of how to implement this. Blog available here:
https://community.sitecore.net/technical_blogs/b/technical-marketing/posts/habitat-federated-authentication-...
- 6,821
3
votes
Accepted
Storing custom data in Redis
We are using this same approach in our Sitecore solution. The main challenge we ran into is that the SecurityTokenValidated event from the OWIN middleware, where you receive the token, runs before the ...
- 1,224
3
votes
2 SXA sites on same Azure app service need different federated authentication providers
I doubt you can have more than one IdentityProvidersProcessor without making alot of customizations. However you could modify the OpenIdConnectAuthenticationOptions in the RedirectToIdentityProvider ...
- 1,224
3
votes
Using Okta OpenId Connect "A client_id must be provided in the request"
In the AddOpenIdConnect function set options.SaveTokens = true; then you can retrieve the token in the OnRedirectToIdentityProviderForSignOut handler using the GetTokenAsync extension method from the ...
- 171
3
votes
Migrate existing Owin implementation from pre-Sitecore 9
As already mentioned by Mark the best way is to use configuration from Sitecore.
Keep in mind the following parts:
IdentityProvidersProcessor
-- here you can set your authentication settings
and ...
- 332
3
votes
Accepted
Add IdentityServer back to Sitecore 10.1.2
It turned out that the last error was due to the application pool identity ApplicationPoolIdentity does not have some permissions in the web folder C:\inetpub\wwwroot\identityserver.dev.local.
The way ...
- 187
3
votes
Accepted
Pages behind authentication not being redirected to azure AD
In order to achieve this, you will need to get the link through GetSignInUrlInfoPipeline pipeline and read the link in the custom processor to redirect to that link before the ExecuteRequest pipeline ...
- 3,709
2
votes
Accepted
LoggedIn processor with federated authentication
You have to use owin.cookieAuthentication.signedIn pipeline.
There are a bunch of fedauth-related pipelines (like owin.cookieAuthentication.*) defined in the \App_Config\Sitecore\Owin.Authentication\...
2
votes
Sitecore Federated Authentication Administrator Group
Assuming you have configured federated authentication properly. You can do this by mapping claims.
This is an excerpt an example from @Bas Lijten 's blog.
As the Administrator role isn’t a real ...
- 1,792
Only top scored, non community-wiki answers of a minimum length are eligible