Understanding Sitecore authentication behavior changes

By default, Sitecore configures the SI server provider to handle authentication for the Sitecore Client sites, for example shell and admin, only. This means if you authenticate in shell through the SI server, website does not accept that user and you  are anonymous in the website. It also means that if you use the GetSignInUrlInfoPipeline pipeline to generate sign-in links on your website, then the login link to sign-in with SI server does not unexpectedly appear there.

To configure authentication scope:

Sitecore comes with several mapEntry nodes that have predefined site lists. Every node has a name attribute with a meaningful value:

By default, the SI server provider is placed in the sites with the core and unspecified database mapEntry node.

Before SI, you used the /sitecore/login and /sitecore/admin/login.aspx URLs  to log in to the shell and admin sites, respectively. These URLs are not used with Sitecore Identity.

We recommend that you use the  /sitecore or /sitecore/admin URLs to access Sitecore, and that you use the Logout button to sign out or change to another user.

Sitecore Federated Authentication provides a new login page endpoint that allows Sitecore to redirect users directly to an external identity provider login page (without showing the login page in Sitecore) and then wait until the user clicks on the corresponding button.

The URL for this new login endpoint has this format: $(loginPath)/{site_name}/{identity_provider}[/{inner_identity_provider}], where:

The SI server provider is configured with the SitecoreIdentityServer name in Sitecore, and the  Sitecore.Owin.Authentication.IdentityServer.config file includes the following:

<sites>
  <site name="shell" set:loginPage="$(loginPath)shell/SitecoreIdentityServer"/>
  <site name="admin" set:loginPage="$(loginPath)admin/SitecoreIdentityServer"/>
</sites>

You can bring back login buttons for previously configured external identity providers in Sitecore 9.0.

The Sitecore.Owin.Authentication.IdentityServer.config configuration file patches the loginPage attributes of the shell and admin sites to new special endpoints handled by Sitecore.

If you try to access the /sitecore/login page when SI is enabled, you are redirected to the login page specified for the shell site, unless they are the same.

Users will end up on the /sitecore/login?fbc=1 page if the SI server is unreachable and Sitecore is unable to obtain its initial metadata.

If you have already configured an external identity provider(s) to sign in users in  shell using federated authentication, then you still have to use the /sitecore/login page because the SI server login page does not show those extra login buttons.

To prevent Sitecore from redirecting users away from the sitecore/login page:

Either of these actions prevents Sitecore from redirecting users away from the /sitecore/login page. The SI server is configured as a regular external identity provider in Sitecore and it means you see its sign-in button on the /sitecore/login page. The caption is Go to login.

The Sitecore instance is an SI client, but you can disable SI so Sitecore works without the SI server, as it did in versions before  9.1.

By default, if the Sitecore instance cannot reach the SI server during the first sign-in after Sitecore has started up, it uses the /sitecore/login page as a login page fallback.

To not use the SI server at all:

To disable OWIN and federated authentication:

Federated authentication has been extended in Sitecore 9.1. It is easier to implement sign out from external identity providers when a user signs out from Sitecore.

When a user signs out from an external identity provider, Sitecore Identity redirects the user to the logout page of this identity provider, and then back to Sitecore. A full sign out from both Sitecore and the underlying identity provider usually cannot happen with a single request. However, Sitecore Identity handles everything automatically when you use the AuthenticationManager.Logout() method.

This functionality is turned on by default only for the SI server provider (SitecoreIdentityServer in the configuration): sitecore/federatedAuthentication/identityProviders/identityProvider[id=SitecoreIdentityServer]/triggerExternalSignOut is true by default.

User account lockout helps to avoid a password-guessing attack known as a brute force attack. A brute force attack is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works.

To configure user account lockout:

There are two types of cookie:

Modern browsers tend to preserve session cookies between browser sessions when the appropriate browser option is turned on. It often makes session cookies behave like persistent ones. OWIN authentication allows you to store the cookie lifespan value in the cookie value itself. It means that the cookie is treated as expired by the web application if the cookie is expired, but the browser still sends it to the server.

To specify the authentication cookie lifetime:

Web applications create persistent authentication cookies when a user selects a Remember me option. Authentication through Federated Authentication produces only non-persistent cookies.

For example, if you sign in through an external identity provider without selecting the Remember me option on that provider, then you have to sign in again after the browser session expires.

If you sign in through an external identity provider and you select the Remember me option on that provider, then you will lose your Sitecore authentication cookie when the browser session expires.  However, after a quick auto-redirect to the identity provider and back, you are automatically signed in to Sitecore again.

To override the cookie ExpireTimeSpan  setting for specific identity providers:

This value indicates the time on or after which the authentication cookie must not be accepted for processing by the browser.

Sitecore uses the exp claim value for the Sitecore Identity server provider for this purpose - see the Config.Authentication.IdentityServer.Owin.Authentication.IdentityServer.config file:

<sitecore>
  <federatedAuthentication>
    <identityProviders>
      <identityProvider id="SitecoreIdentityServer"  ...>
        <transformations ...>
            <!-- owin.cookieAuthentication.signIn pipeline uses http://www.sitecore.net/identity/claims/cookieExp claim to override authentication cookie expiration.
                 'exp' claim value can be configured on Sitecore Identity server on the client configuration by IdentityTokenLifetimeInSeconds setting.
                 Note: Claim value is Unix time expressed as the number of seconds that have elapsed since 1970-01-01T00:00:00Z -->
            <transformation name="use exp claim for authentication cookie expiration" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
              <sources hint="raw:AddSource">
                <claim name="exp"/>
              </sources>
              <targets hint="raw:AddTarget">
                <claim name="http://www.sitecore.net/identity/claims/cookieExp"/>
              </targets>
              <keepSource>true</keepSource>
            </transformation>