How to secure Sitecore GraphQL?

 

Authentication Options:

1. Expose GraphQL via Azure APIM and allow APIM to connect to GraphQL using Sitecore API Key

2. Use Azure Active Directory B2C JWT Token

   1. OAuth 2.0 Client Credential Grant Flow [Get direct authorization]

   2. OAuth 2.0 Authorize Code Grant Flow[Get Auth Code- Using Auth Code Get Access-Token ]

3. Use Sitecore Identity Server JWT Token

4. Sitecore Authentication (cookie base)

1. Authentication

Why Option #1- Expose GraphQL via Azure APIM is preferred solution

1. Sitecore API Key will need to be created within Sitecore and enable GraphQL endpoints.

2. Expose sitecore graphQL end point via Azure APIM.

3. Consuming client will need to provide the Azure APIM subscription key as part of the request Authorization request header.

4. The APIM behind the scene will pass the sitecore API key to Sitecore graphQL server.

5. Each Sitecore API Key will have sitecore custom role assigned, which will enable us to implement content level authorization.

6. Can take advantage of security and request throttling features that APIM provides out of box.

2. Authorization

Sitecore out of box role based permission/authorization can be used to grant/deny access to specific part of sitecore content tree. High level steps:

1. Create a new sitecore role and assign the grant/deny access to sitecore content tree.

2. And assign this newly created role to the sitecore API key that we have created above as part of Authentication [Go to sitecore content tree-> Settings--> Services--> API Keys--> Any GraphQL item--> Under Item section Data-->In Impersonation user --> Enter Sitecore role created in pt1]

Deny Mutation (Create/Update/Delete) & Subscriptions

By default Mutation & Subscriptions are enabled on Sitecore.Services.GraphQL.Content.Config

In order to fix this either patch or create a new context aware graphQL end point and disable Mutation/Subscription

References:

OAuth 2.0 Client Credential Grant Flow [Get direct authorization]

https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow OAuth 2.0 Authorize Code Grant Flow[Get Auth Code- Using Auth Code Get Access-Token ]

https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow

Create self signed SSL certificate to host sitecore CD CM in IIS with https

Open powershell in admin mode

1. Run below set of commands

New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -dnsname "sitecorewebsite.cd" -FriendlyName "sitecorewebsite.cd" -NotAfter (Get-Date).AddYears(5)

2. copy and note down the Thumbprint value generated from above powershell Command

3. Run below command

Export-Certificate -Cert cert:\localMachine\my\<paste- copied-thumbprint-of-cert-value> -FilePath "C:\certificates\sitecorewebsite.cd.pfx"

Make sure self signed ssl cert created for right website name for e.g sitecorewebsite.cd

4. Go to c:/certificate and lookup for generated certificate name as sitecorewebsite.cd.pfx

5. Next step is to add the above generated certificate to a trusted certificate authority

6. Go to run and type mmc.exe

7. Select file-->Add/Remove-snap-in

8. Double click on certificates, Choose the ‘Computer account' option, then 'Local computer’ & Click Finish

9. The cert that you exported should already be visible in the 'Personal' store of your Local Computer

10. Copy the cert from personal store and paste it in Trusted Root Certificates Authorities

11. Go to IIS and navigate your site, add binding https and select the certificate from the dropdown. Restart IIS and you should be able to browse your site with https.
    

Change the default Sitecore CM CD website name and publish folder path

When installing vanilla sitecore 10 and above , make sure you change the default website directory path otherwise the Sitecore will install the content delivery and content managed website in c:/inetpub/wwwroot.

When you download setup file from Sitecore download repository , make sure you make changes to setup files.

1. Update Physical folder path

To update the folder path, update the XM1-SingleDeveloper.json file and change the default value to the desired folder location.

Look for "SitePhysicalRoot" node and child property or attribute "DefaultValues": "c:/{someworkingfolder}/{YourSitecoreWebsiteName}

2. Give IIS_IUSRS permission to sitePhysicalRoot

Make sure the parent folder {someworkingfolder} has the necessary security permissions. Give permission to (IIS_IUSRS)

3. Rename your website name that is hosted in IIS

To update the Local instance to be the same as our current url, update the setup.exe.config file and update the following values: Look for parameter that value ="{prefix}.cd"

parameter that has value="{prefix}.cm" You are all set! Happy Coding!

Estimation prerequisites for Sitecore Migration and upgrade

 When we planning any sitecore upgrade from lower version such sitecore 8.0+ to sitecore 10+. It is always recommended to understand the dependencies , integration touch points and library.

• .Net framework vs .Net core any nuget /assembly/library/dll
• Solr
• Active Directory
• SQL server version
• IIS
• Federated Login Identity
• Asp.net mvc if it is mvc project
• Decide XM vs XP
• Mongo DB database migration to XConnect
• Azure Kubernetes require Sitecore v10.3.0

Sitecore Compatability table- XP|XM

https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0087164

Sitecore Solr Compatability table

https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0227897

Sitecore MongoDb Compatability table

https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0633863

Refused to apply style from launchpad.css because its mime type is not supported

If you happen to load sitecore cms and your static content is broken and unable to load static content like js, css and images then it is due to IIS is not enabled with static content.

Refused to apply style from launchpad.css because its mime type is not supported

 

Resolution:
Go to Control Panel > Turn Windows features on or off > Internet Information Services > World Wide Web Services > Common HTTP Features > Static Content. 

Make sure you run IISreset to see the effect.

Sitecore Azure AD B2C User.Identity.IsAuthenticated is false Set AuthenticationManager

 

Solution to use ExternalLoginCallBack

Sitecore exposes /identity/externallogincallback URL which basically invokes the HandleLoginLink processor whose primary responsibility is to transfer the AspNet.ExternalCookie issued by OIDC in to final AspNet.Cookies authentication token. The sitecore virtual users then get created and session is initialized. Therefore we must include the above end point as our callback end point. Once this callback is triggered, it will redirect the user to returnUrl specified.

https://stackoverflow.com/questions/29907155/external-cookie-for-external-login-in-asp-net-owin

https://blog.baslijten.com/federated-authentication-in-sitecore-error-unsuccessful-login-with-external-provider

Technically this is what it does behind the scene- This is just a hack , don't use this. Refer above code snippet to redirect to Sitecore external call back to get away with External Cookie reference.

Kubernetes 101 Know how

Clusters| Nodes| Pods| Helm

Node := Master Node + No. of Worker Nodes

Analogy: Cluster is like a train and Nodes are just like a compartment 

Kubernetes clusters are comprised of one master node and a number of worker nodes. These nodes can either be physical computers or virtual machines, depending on the cluster. The master node controls the state of the cluster; for example, which applications are running and their corresponding container images. 

How many clusters are in Kubernetes?

25 supports clusters with up to 5000 nodes. More specifically, Kubernetes is designed to accommodate configurations that meet all of the following criteria: No more than 110 pods per node. No more than 5000 nodes

What are pods and clusters in Kubernetes?

A Kubernetes cluster consists of a set of worker machines, called nodes, that run containerized applications. Every cluster has at least one worker node. The worker node(s) host the Pods that are the components of the application workload. The control plane manages the worker nodes and the Pods in the cluster.

Helm is a Kubernetes deployment tool for automating creation, packaging, configuration, and deployment of applications and services to Kubernetes clusters. Kubernetes is a powerful container-orchestration system for application deployment

Solr Value cannot be null. Parameter name: fieldNameTranslator

Problem

Server Error in '/' Application.

---

Value cannot be null.
Parameter name: fieldNameTranslator

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.ArgumentNullException: Value cannot be null.
Parameter name: fieldNameTranslator

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[ArgumentNullException: Value cannot be null. Parameter name: fieldNameTranslator] Sitecore.ContentSearch.Linq.Solr.SolrIndexParameters..ctor( Sitecore.ContentSearch.SolrProvider.LinqToSolrIndex`1..ctor Sitecore.ContentSearch.SolrProvider.SolrSearchContext.GetQueryable(IExecutionContext[] executionContexts) +229 Sitecore.ContentSearch.SolrProvider.SolrSearchContext.GetQueryable() +65 Sitecore.ContentTesting.ContentSearch.TestingSearch.GetAllTests() +132 Sitecore.ContentTesting.Data.SitecoreContentTestStore.GetAllTestsForItem(DataUri hostItemDataUri, String searchText) +80 Sitecore.ContentTesting.Pipelines.GetContentEditorWarnings.GetContentTestingWarnings.AddSuspende Sitecore.ContentTesting.Pipelines.GetContentEditorWarnings.GetContentTestingWarnings.Process(GetContentEditorWarningsArgs args) +45 (Object , Object[] ) +56

Bit of a hack!

Temporary Solution
Go to sitecore.contentsearch
EnableSearch=false

Performance Optimization:SItecore 9.2 Content Delivery Server

After migrating website from sitecore 8.2.1 to sitecore 9.2 I noticed my application was extremely slow. The only place I could search for an issues , is sitecore log app_data/logs . The initial reaction after looking at it was seeing whole lot of different log files.

The first reaction was to look at this logs closely. I found there were lot of exception around Xdb to Xconnect which is kind of real problem. Then later I realised Redis cache is playing up. Then I found there is no need of Email EXM manager as I'm not using it. I even created config patch to remove unnecessary log files which is not adding any value. One of the kind was performance log counter that sits under app_data diagnostic folder. Health Monitor an all.

https://doc.sitecore.com/developers/91/platform-administration-and-architecture/en/content-delivery--cd-.html

Glass Mapper V5 for sitecore 9.2 breaking change SitecoreChildren Islazy is not lazy any more

    public partial interface ICategoryFolderEntity
    {
        /// 

        /// Gets list of category in this folder
        /// 
        [SitecoreChildren()]
        IEnumerable CategoryList { get; }
    }
public partial class CategoryFolderEntity : ICategoryFolderEntity
    {
        /// 

        /// Gets list of category in this folder
        /// 
        [SitecoreChildren]
        public virtual IEnumerable CategoryList { get; set; }
    }

No need of

[SitecoreChildren(IsLazy = false)]

Just  [SitecoreChildren]

And virtual IEnumerable CategoryList

Remember Virtual

Reference:

https://sitecore.stackexchange.com/questions/16530/after-upgrading-to-glass-mapper-5-unable-to-globally-enable-lazy-loading

Sitecore 8.2 Migration to sitecore 9.2 DLL Hell

While we migrate sitecore mvc .net solution, one need to be very careful with following set of dlls that might conflict with version and you end up spending time to do patching the version in web.config or in app.config files.

Here is the key:-

Sitecore 8.2 per say have .Net framework 4.5.2 and all the dependency dll must match otherwise you might end up seeing these kind of exception every time. Indeed you're deep down the rabbit hole.

Before you start, take note of all version of below dlls in your vanilla sitecore installation /bin folder sitecore 9.2 -.Net framework 4.7.1 / 4.7.2

Even sitecore documentation doesn't give you the summary for the version of dll it supports, the way  they have compatibility tables for all platform dependencies. Similarly it is good to have those dll version dependencies with which they have constructed the sitecore framework.

Go in this order and ensure your webapps and project library have consistent dll across:-

Sitecore Intrinsic Assembly Reference

• Sitecore.Kernel
• Sitecore.ContentSearch
• Sitecore.ContentSearch.Linq
• Sitecore.Mvc
• Sitecore.Client
• Sitecore.Analytics
• Sitecore.Analytics.Model

.Net Framework Assembly Reference

• System.Web.Mvc
• System.Web.Http

The King's Newtonsoft.Json

• Newtonsoft.Json (This one in specific would be challenge in terms of mvc vs Owin connectors). Slight version deviation would take much of your time.)

DI - Reference

• Microsoft.Extensions.DependencyInjections.Abstractions

Identity Owin

• Owin
• Microsoft.Owin

Solr

• SolrNet

If the version mismatch is handled correctly, the first hurdle of migration is through. Trust me most of the blogs out there talks about sitecore 9.2 installation and setup. They are good but no one has given the actual migration of .net solution that will haunt you when you get started. 

Once you are through with this DLL Hell! You then probably have to focus and deal with app_config patch that is specific to your application domain. There is a change which is more related to Xconnect vs XDB. 

In fact sitecore migration is really a painful task. Also the worst part is sitecore is going to end support for sitecore 8.2 soon. As an application architect one has to plan such migration meticulously otherwise your enterprise application which was developed with sitecore 8.x hoo haa! might become a legacy in no time.

Mainstream support for Sitecore 8.2 is going to end soon  

https://kb.sitecore.net/articles/641167

https://kb.sitecore.net/articles/087164

As an architect, it is no point to start any new project on .Net framework based cms as microsoft has put an end to .Net framework. They lately said .Net framework 4.8 is the last in its journey.

“The .NET Framework is on it’s last release — there will not be another one after 4.8”

https://devblogs.microsoft.com/dotnet/net-core-is-the-future-of-net/

https://betanews.com/2019/05/07/future-of-dotnet/

https://medium.com/@andy.watt83/the-net-framework-is-done-8aec3bbae12d

Sitecore 8.2 to sitecore 9.2 migration: Not an easy task

Having said that sitecore 9.2 changes are far more different from sitecore 8.2 . If you look at the Kb site and even sitecore 9.2 xconnect, Identity server and so on. It comes with lot of changes which makes CD .net solution migration unbearable.

The main pain areas that would need tackle. I'm not talking about mongo db /Xdb or Xconnect , cms migration stuff. I'm talking about sitecore mvc .net solution what needs to be replatform. It  is huge effort. I wondered sometime , is it worth doing sitecore 8.2 to sitecore 9.2 migration or shall I wait for sitecore to reflatform its whole technology stack into .NET Core.

Pain areas:-

• App_Config
• Reference dll, mvc, kernel, dependency injection and so on.
• Glass mapper version, if your are using it
• TDS version
• T4MVC template
• MVC .net version
• . Net Framework 4.5.2 to 4.7.2

Sitecore MVPs out there has done great job promoting sitecore 9 but coming to replatform whole existing site into sitecore 9 is huge task.

Then there are heaps of other minor stack of application architect that you might have to replatform or refactor.

A Day in the life of sitecore developer

Just to be specific sitecore developer working on .Net cms part of it. Sitecore is vast.

Junior Sitecore Developer

Able to Implement/develop/code with .net and sitecore item

Sitecore Developer

Able to Implement/develop/code with .net and sitecore item
Tools :

1. Sitecore Rocks
2. SIM
3. TDS
4. Sitecore Powershell extension
5. Sitecore Log Analyzer

Senior Sitecore Devs

Able to Implement/develop/code with .net and sitecore item
Tools :

1. Sitecore Rocks
2. SIM
3. TDS
4. Sitecore Powershell extension
5. Sitecore Log Analyzer
6. Azure Devops
7. Raise Sitecore Ticket , know how proc dump, sitecore support request handling
8. Performance debugging and troubleshooting. Working with perf team on load testing and so on

Sitecore Smart Strategic Move BUT it is long way to

Acquired Hedgehog!

Sitecore Announces Intention to Acquire Hedgehog, Plans Expanded Support for Partner Ecosystem to Help Accelerate Digital Transformation Initiatives for Customers

https://www.sitecore.com/company/press-and-media/press-releases/2019/05/sitecore-announces-intention-to-acquire-hedgehog-plans-expanded-support-for-partner-ecosystem

At the moment, I still feel, the heart of sitecore and main driver for them is Sitecore CMS engine which is what the main area of progress. Right now Sitecore is trying to jump into so many things that is very hard to create a good marketplace unless its so called chosen MVPs drive it to its great potential. That I think is next to impossible. 

There are lot of loop holes and gaps how Sitecore select its MVPs. If you look at how Microsoft select and get its MVPs is based on lot of criteria. Not to go too much into this right now. 

What my intent is what Sitecore should now? Why sitecore investment in cortex, ecommerce and other digital stuff needs thorough lookout.

Small things can do wonders for Sitecore:-

1. Sitecore may include glass mapper to it

2. Sitecore should focus on SXA . I think it is got potentials

3. Sitecore should revamp cms UI and make it more fluid. Content Author not liking the old use interface, usabiility and other stuff.

Big Bang ! Dot Net Core

Sitecore should move to .net core as soon as possible, Lot of things to get going. It has huge savings in terms of infrastructure, performance, availability and scalable.