we have setup IdentityServer 3 as IDP for our test Sitecore setup. However, we are not able to map incoming federated logins to existing users (Users created with legacy forms authentication enabled).

Does anyone know if this can even be done with Sitecore 9.0.1 (or newer)?

By default Sitecore will create a new user the first time a federated login is authenticated, and it is this I'm trying to change to instead actually MAP to the existing user

I have overridden DefaultExternalUserBuilder, but implementing BuildUser/CreateUniqueUserName to that of an existing user results in the same message

Unable to create a user. Reason: DuplicateUserName" error.

Best regards, Kim

1 Answer 1


The user, which is being created while processing federated authentication request, is actually a virtual user. That virtual user is different then what Sitecore is having out of the box and what admin can create using User Manager.

Another point is, all existing Sitecore Membership users have their password associated with their account but in case of virtual user, there is no password as it is managed by external system and not by the Sitecore. Behavior of both type of user is different and that is why Sitecore has concept of Virtual user.

You can not map all those users with the federated users OOTB. If you really want to do that, you may need to customize the code by overriding ApplicationUserResolver class to consider your own logic to resolve external user.

However, it is not recommended to change this behavior.

If you want to map existing user just to retain their access rights configuration, i would suggest to go with OOTB way of virtual users creation in the different domain and mark those virtual users as persisted user by setting a value true in OWin configuration field called isPersistentUser.

<externalUserBuilder type="Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, Sitecore.Owin.Authentication">
    <param desc="isPersistentUser">true</param>

For more information about Virtual user creation, you can follow this link..


  • Hi Arvind - thank you for your quick reply. I have already implemented isPersistentUser, but this goes against our wish of actually mapping incoming federated virtual users to "actual" Sitecore users (Our existing user-base), because a new one will be created for the federated user. I will check out overriding the ApplicationUserResolver and see if that can assist the process. Dec 21, 2018 at 14:23
  • As i mentioned in the answer you may need to customize ApplicationUserResolver class to consider your own logic to resolve external user. However, it is not recommended to change this behavior. Dec 21, 2018 at 14:25
  • Kim Køhler, Did you try to customize the ApplicationUserResolver, we have the same requirement to make use of the existing sitecore user with Federated Authentication
    – PVM
    May 20, 2020 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.