---
title: "Configure a Sitecore instance and Sitecore Identity server"
slug: "configure-a-sitecore-instance-and-sitecore-identity-server"
abstract: "How to configure Sitecore instances and Sitecore Identity server"
---
# Configure a Sitecore instance and Sitecore Identity server

To configure a Sitecore instance to use Sitecore Identity (SI) server authentication you must:

- [Configure the Sitecore instance](https://doc.sitecore.com/xp/en/developers/101/sitecore-experience-manager/configure-a-sitecore-instance-and-sitecore-identity-server.html#UUID-9e5930f8-0926-d127-d62c-b23e374b55ed_section-idm46212284250992 "Configure the Sitecore instance")
- [Configure the Sitecore Identity server](https://doc.sitecore.com/xp/en/developers/101/sitecore-experience-manager/configure-a-sitecore-instance-and-sitecore-identity-server.html#UUID-9e5930f8-0926-d127-d62c-b23e374b55ed_section-idm45900735853216 "Configure the Sitecore Identity server")

For more information about the Sitecore Identity Server components, see [Sitecore Identity Structure](https://doc.sitecore.com/xp/en/developers/101/sitecore-experience-manager/sitecore-identity-structure.html "Sitecore Identity structure").

<details>
<summary><h2>Configure the Sitecore instance</h2></summary>

To configure the Sitecore instance, enable every Sitecore instances that uses SI server authentication with:

- The absolute URL of the SI server (*Authority* in OpenId Connect terminology). You set this in the `$(identityServerAuthority)` configuration variable. It is specified in the deployment process.
- The ID of the registered client. Sitecore has a default client configured in SI server with ID `Sitecore`. Sitecore stores this ID in the

    `FederatedAuthentication.IdentityServer.ClientId` setting.

- The ID of a dedicated client for the custom *Resource Owner Password* flow. Sitecore uses a custom *Resource Owner Password* flow for internal purposes. The `FederatedAuthentication.IdentityServer.ResourceOwnerClientId` setting  specifies the ID of this client. The default value is `SitecorePassword`.

Sitecore connects the SI server according to the [federated authentication configuration](https://doc.sitecore.com/xp/en/developers/101/sitecore-experience-manager/configure-federated-authentication.html "Configure federated authentication").

</details>

<details>
<summary><h2>Configure the Sitecore Identity server</h2></summary>

The Sitecore Identity server must contain the configuration of all its clients (see IdentityServer4 client). 

To configure  the Sitecore Identity server:

1. Set the client secret in the `Sitecore:IdentityServer:Clients:PasswordClient:ClientSecrets: ClientSecret1` setting in the `Config\Sitecore.IdentityServer.Host.xm`l file on the Sitecore Identity server. 

    It must be the same as the client secret in the `App_Config\ConnectionStrings.config` file, in the `sitecoreidentity.secret` connection string, on the Sitecore instance.  

    When you install Sitecore XP, the client secret is set to Sitecore Identity Server by default and you do not need to perform this step.

2. To allow Sitecore users to sign in, in the `Config\Sitecore.IdentityServer.Host.xm`l file, in the `Sitecore:IdentityServer:SitecoreMembershipOptions:ConnectionString` setting, configure the connection string to the *Security* database.
3. To allow users to recover their passwords, in the `Config\Sitecore.IdentityServer.Host.xm`l file, configure the `Sitecore:IdentityServer:AccountOptions: PasswordRecoveryUrl` setting.

    When you install Sitecore XP, the link to the Sitecore instance is used by default and you do not need to perform this step.

4. Use either the `Sitecore:IdentityServer:Clients` section to configure clients, or use dependency injection.

    Each client configuration node contains a number of properties that are bound to properties of the `IdentityServer4.Models.Client` class. In most cases, the names of class properties and configuration properties are matched. Alternatively, you can use dependency injection to access the whole set of IdentityServer4 options.

    > [!note]
    > There is a predefined client called `Sitecore`  (`Sitecore:IdentityServer:Clients:DefaultClient`).

5. To reuse the default `Sitecore` client declaration, extend the lists of allowed `RedirectUris`, `PostLogoutRedirectUris`, and `AllowedCorsOrigins` values to contain the appropriate values for your application.

    You can use the `{AllowedCorsOrigin}` special token in `RedirectUris` and `PostLogoutRedirectUris` lists, as in the following example (this is in the `Config\Sitecore.IdentityServer.Host.xml` file:

    ```xml
    <?xml version="1.0" encoding="utf-8"?>
    <Settings>
      <Sitecore>
        <IdentityServer>
          <Clients>
            <DefaultClient>
              ...
              <RedirectUris>
                <RedirectUri1>{AllowedCorsOrigin}/identity/signin</RedirectUri1>
                <RedirectUri2>{AllowedCorsOrigin}/signin-oidc</RedirectUri2>
              </RedirectUris>
              <PostLogoutRedirectUris>
                <PostLogoutRedirectUri1>{AllowedCorsOrigin}/identity/postexternallogout</PostLogoutRedirectUri1>
                <PostLogoutRedirectUri2>{AllowedCorsOrigin}/signout-callback-oidc</PostLogoutRedirectUri2>
              </PostLogoutRedirectUris>
              ...
    ```

6. To  specify a `protocol+domain+port` part of URLs only in the `AllowedCorsOrigins` section, use the `{AllowedCorsOrigin}` token:

    ```xml
    <?xml version="1.0" encoding="utf-8"?>
    <Settings>
      <Sitecore>
        <IdentityServer>
          <Clients>
            <DefaultClient>
              ...
              <AllowedCorsOrigins>
                <AllowedCorsOriginsGroup1>https://host1|http://host1</AllowedCorsOriginsGroup1>
                <AllowedCorsOriginsGroup2>https://host2</AllowedCorsOriginsGroup2>
                <AllowedCorsOriginsGroup3>https://host3</AllowedCorsOriginsGroup3>
              </AllowedCorsOrigins>
              ...
    ```

    Sitecore expands the `RedirectUri*` and `PostLogoutRedirectUri*` node values with {`AllowedCorsOrigin}` tokens to be allowed for every origin specified in the `AllowedCorsOrigins` list.

</details>