Cant download Result when logged in Using OKTA SSO

[jietnitish]

Expected Behavior

User should be able to download the report in CSV and/or Excel

Actual Behavior

Nothing is happening when you click CSV or Excel Button when logged in via OKTA SSO

Steps to Reproduce the Problem

Sitecore Version 9.3
Powershell Module Version 6

1. Login to CMS via SSO (Azure / OKTA)
2. Navigate to Start --> Reporting --> PS Reports-->Content Audit-->Broken Link
3. Execute th script and make sure you get some output
4. Click on CSV or Excel

Validate the same behavior using normal Sitecore Login and this will work.
When I checked the network tab for all the call, I can see one differene in working scenario vs non working scenario

Request : /sitecore/shell/applications/powershell/powershelllistview?sid=9510dfc9-e66f-45ba-8178-64c330b4fc42

Response for Working Scenario
{
"commands": [
{
"command": "UnregisterKeyGroup",
"value": "PowerShellRibbon"
},
{
"command": "SetInnerHtml",
"value": "SOME DATA GOES HERE...REMOVED FOR TICKET",
"id": "RibbonPanel"
},
{
"command": "SetPipeline",
"value": "98715B6C8CA74550B0D8E51DB94F633A"
},
{
"command": "Eval",
"value": "spe.DownloadReport('A14F173DE53C4B218A76DEBD8F7CF1CD');"
}
]
}

Response for Non Working Scenario

{
"commands": [
{
"command": "UnregisterKeyGroup",
"value": "PowerShellRibbon"
},
{
"command": "SetInnerHtml",
"value": "SOME DATA GOES HERE...REMOVED FOR TICKET",
"id": "RibbonPanel"
}
]
}

If you see, in non working scenario, 2 commands are not coming in response which might be causing this issue,

[michaellwest]

@jietnitish Are there other issues you have noticed that do not work? Do you have the Spe.IdentityServer.config enabled?

[jietnitish]

Hi @michaellwest , Yes... above config file is enabled
Also if I try to execute any script from Powershell ISE, then I am getting a popup to Elevate Session, which I am not able to do so because I have logged in via OKTA SSO and we are not creating persisten user.
If I go via Start --> Reporting --> PS Reports-->Content Audit-->Broken Link route, then I am able to execute the script, but not able to download the report.

As in my above comment, some response is missing in JSON which could be causing this issue.

[michaellwest]

In SPE 6.2 you can change the elevate access to use "Confirm" instead of "Password". That could get you past the dialogs asking for password.

If you can apply the shields down patch to Allow everything instead of requiring the password then we can narrow down which option is giving you trouble.

[jietnitish]

@michaellwest I did not understand "If you can apply the shields down patch to Allow everything instead of requiring the password then we can narrow down which option is giving you trouble."
Also we are using SPE 6.0

[jietnitish]

@michaellwest Is it related to this https://alan-null.github.io/2017/01/spe-dev-config ?

[michaellwest]

Yes that's what I was thinking about. In the patch there are sections for each of the types of services offered by SPE. The ability to download is probably the handle service.. My guess is it fails to authenticate when using that feature.

[jietnitish]

@michaellwest , using the patch resolved the "Elevate Session" problem. But still I am unable to downaload the result.

[jietnitish]

When trying download option via SSO Login (OKTA)

When trying download option via Sitecore Login

Network Tab Response for SSO Call (Where download is not working)

Network Tab Response for Normal Login Call (Where download is working)

[michaellwest]

Taking a guess, the user is not detected in one of these:

<handleDownload enabled="true" requireSecureConnection="false">
          <authorization>
            <add Permission="Allow" IdentityType="Role" Identity="sitecore\PowerShell Extensions Remoting" />
            <add Permission="Allow" IdentityType="Role" Identity="sitecore\Sitecore Client Users" />
            <add Permission="Allow" IdentityType="Role" Identity="sitecore\IsAdministrator" />
          </authorization>
</handleDownload>

[jietnitish]

We have looked at this option as well. User logged in via OKTA is Admin User. I can try adding a role here and map the same with logged in OKTA User

[michaellwest]

Do you think this fixes your issue? #1227

[jietnitish]

Hi @michaellwest , I allowed a role in handleDownload authorization, but still issue exist.
For testing purpose. I explictly added a role "sitecore\IsAdministrator" to incoming user while mapping cliams to Sitecore role, but that also does not resolve the issue.

[jietnitish]

@michaellwest can you share the package mentioned at 1227 ?

[michaellwest]

I never created it as the user was able to build their own. Essentially compile the latest version of SPE, or branch of the version you have, and then add in the fix.

[jietnitish]

Hey @michaellwest , tried above by customizing the code, still same issue