Sitecore Identity Server (SI) handles authentication for the Sitecore platform. For security, it uses a Cross-Origin Resource Sharing (CORS) policy to ensure that authentication requests only come from trusted domains. When the Content Management (CM) instance is accessed via a new hostname, that hostname must be added to the SI's list of allowed origins. The AllowedCorsOriginsGroup setting in the SI's configuration (Config/production/Sitecore.IdentityServer.Host.xml) is the designated mechanism for adding multiple hostnames, allowing users to log in successfully from each one.

A. Patching web.config with permission groups relates to authorization (what a user can do after logging in), not the initial authentication process handled by the Identity Server.

B. Updating user roles also pertains to authorization within Sitecore and does not affect the ability to authenticate against the Identity Server from a specific hostname.

C. Using wildcards is a less secure practice. The recommended approach is to explicitly define each allowed origin, which provides better security control over authentication requests.

1. Sitecore Documentation - Configure Sitecore Identity: "The Sitecore Host application uses a CORS policy to validate all requests. You must register every client that communicates with Sitecore Identity in the [sitename].identityserver appsettings.json file or in the Sitecore.IdentityServer.Host.xml file... To add a list of hosts

you can create a new group in the AllowedCorsOrigins section. The group name must end with the suffix Group."

Source: Sitecore 10.0 Documentation

Security Guide

Chapter 2: Authentication

Section: Configure Sitecore Identity.

2. Sitecore Documentation - Walkthrough: Using a custom client for federated authentication: This guide demonstrates the configuration required for a new client

including the AllowedCorsOrigins setting. It states

"In the AllowedCorsOrigins section

in the AllowedCorsOriginsGroup1 subsection

in the Value field

enter the URL of the client application." This reinforces that each client origin URL must be explicitly added.

Source: Sitecore 10.0 Documentation

Security Guide

Chapter 2: Authentication

Section: Walkthrough: Using a custom client for federated authentication.