1

I have a Sitecore 9 site configured to use an OWIN provider as described in this article. The site also allows users to authenticate via forms authentication. The two authentication methods are working at this point.

Here's the issue: Whenever a user hits a page that they are unauthorized to view, Sitecore immediately redirects them to the OWIN providers's login page. What we need instead is for Sitecore to display a custom 403 Unauthorized page with relevant information. We have installed the plugin "Sitecore Error Manager", so we already have the ability to display a 403 page.

How do we change this behavior and tell Sitecore to redirect to our 403 page instead of the federated auth login page?

  • Is this sitecore 9? Very strange it's redirecting to provider without any interaction – josedbaez Aug 13 '18 at 9:56
  • Yes, it is Sitecore 9. – Anders Aug 14 '18 at 10:53
3

You can set the NoAccessUrl setting or the loginPage attribute on the sitedefinition to point to your custom page. This article has an example of using the NoAccessUrl to point to a custom page.

|improve this answer|||||
  • Sadly, this didn't solve the issue. Sitecore redirects to the federated site's login page no matter what I set for the site definition's "loginPage" value. I've ensured that it's using the right site definition by appending sc_site=website to the URL with the same result. Same goes for NoAccessUrl. It already had a value - "/sitecore modules/Web/Error Manager/403.aspx?key=NoAccessUrl - due to the Sitecore Error Manager plugin. – Anders Aug 6 '18 at 12:30
  • Jeroen, we are still facing this problem. We are running Sitecore 9 update-1. Do you know if this issue was addressed in the Sitecore 9 update-2 release? It seems to me like an internal error of some sort. – Anders Sep 26 '18 at 10:52
  • Not sure if anything related to this was addressed in update 2. This is working for me in Sitecore 9 update 1. – Jeroen Sep 26 '18 at 14:11
1

This wasn't a Sitecore issue - it was an MVC issue. The redirects to the login page were occuring when we hit a controller decorated with [Authorize] that we weren't authorized for.

To change this behavior, we extended the Authorize attribute and set a custom redirect URL like this: https://forums.asp.net/t/2039316.aspx?Change+redirect+page+when+user+is+unauthorized

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.