When trying to configure external authentication provider, Sitefinity redirects to the external identity provider login screen. When the response comes after authenticating in the provider to the Sitefinity callback path with the id_token, there is a - HTTP Error 401.0 Unauthorized Requested URL [domain]/Sitefinity/Authenticate/OpenID/signin-custom

The OpenID Connect provider in Sitefinity supports the implicit client authentication flow. The Implicit Flow follows the following steps:

1) Client prepares an Authentication Request containing the desired request parameters.
2) Client sends the request to the Authorization Server.
3) Authorization Server Authenticates the End-User.
4) Authorization Server obtains End-User Consent/Authorization.
5) Authorization Server sends the End-User back to the Client with an ID Token and, if requested, an Access Token.
6) Client validates the ID token and retrieves the End-User's Subject Identifier.

When Sitefinity makes the first authorize request to the external provider it passes 2 parameters in the payload:
response_mode: form_post
response_type: id_token

response_type - This parameter informs the Authorization Server of the desired authorization processing flow. Sitefinity passes id_token value to the Authorization Server which means that the implicit flow is used. The default response_mode for the implicit flow is fragment which means that all response parameters are added to the fragment component of the Redirection URI ([domain]/Sitefinity/Authenticate/OpenID/signin-custom#id_token=...).

response_mode - This parameter informs the Authorization Server of the mechanism to be used for returning Authorization Response parameters from the Authorization Endpoint. Since it is optional, if it is not set, the default Response Mode for the Response Type will be used. Sitefinity sends form_post as a value which means that it needs the response to be a POST request.

The external authentication provider does not support form_post response_mode with the implicit client authentication flow. The id_token is passed as fragment in the URL with a GET request to the authentication end point (the default response_mode for the implicit flow). Sitefinity cannot process this request since it expects POST with the id_token sent in the body of the request.

A feature request can be submitted using the Sitefinity Ideas Portal. Customer feedback is valuable and feature requests are monitored by our Product Management team. Feature requests are reviewed during the planning phase of each new product release. Once a feature request is submitted, the Sitefinity Community will have the opportunity to comment on and vote for the feature request.

For detailed information on how to submit a Feature request, please refer to Knowledge Base article How to submit a Sitefinity feature request.
 

The request should be processed by a proxy where the token would be handled and then sent to Sitefinity signin-custom endpoint as a POST request. In the suggested approach an html page is used as a proxy. The approach suggests that after authenticating in the external provider, the GET request with the id token in the URL is sent to callback.html (attached to the article). On the callback.html there is a form with 2 input fields - one for the id token and one for the state. These are the 2 parameters that Sitefinity expects to receive in the body of the POST request to signin-custom. The JS that is loaded with the page (callback.js, also attached) processes the fragment and submits the form to the signin-custom endpoint.

To achieve this follow the steps below:

1) Extract the files attached and place them in the root of the project
2) Include them and rebuild the solution
3) Go to the configuration of the external provider (Administration -> Settings -> Advanced -> Authenticaiton -> SecurityTokenService -> AuthenticationProviders -> OpenIDConnect)
4) Change the following configurations:

redirectUri="https://[domain]/Sitefinity/Authenticate/OpenID/signin-custom"
callbackPath="/Sitefinity/Authenticate/OpenID/signin-custom"
postLogoutRedirectUri="[domain]"
NotificationsType="SitefinityWebApp.SitefinityOpenIdConnectAuthenticationNotificationsCustom"

5) Restart the application

References to Other Documentation:
OpenID Connect Core 1.0
https://openid.net/specs/openid-connect-core-1_0.html