Currently we are having problem in upgrading to Sitecore 9.1 Problem started to happen after Sitecore 9.1 introduced IdentityServer based authentication.

Sitecore 9.1 uses <add key="owin:appStartup" value="Sitecore.Owin.Startup, Sitecore.Owin" /> which becomes a problem because we have our own Identity server which is being used to authenticate our user for our website. We rather loaded our own Startup from custom assembly.

<add key="owin:appStartup" value="AssemblyA.Identity.Startup, AssemblyA.Identity" />.

Our users are completely separate from Sitecore users. They don't need to participate in any sitecore content related activities. As for now the startup is already occupied by Sitecore.Owin, we cannot load our assemblies and as a result website login is broken.

But we also don't want to disable the Sitecore's own identity based login for experience editor.

Can we keep both system running side by side? Right now this is a hinder for upgrading Sitecore 9.1

I used XP0-SingleDeveloper.ps1 scirpt for installation.

I tried to inject our CookieAuthenticationOptions through pipeline.

My patch:

<owin.initialize> <processor type="ABC.Core.Identity.CookieAuthentication, ABC.Core.Identity" resolve="true" patch:before="processor[@method='Authenticate']" /> </owin.initialize>

Processor code:

public override void Process(InitializeArgs args)
   JwtSecurityTokenHandler.DefaultInboundClaimTypeMap = new Dictionary<string, string>();

   args.App.UseCookieAuthentication(new CookieAuthenticationOptions
                CookieName = "abc.private.cookies",
                AuthenticationType = "Cookies"

   args.App.UseCookieAuthentication(new CookieAuthenticationOptions
                AuthenticationType = "TempCookie",
                AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive,

after applying this code I am getting following error:

Exception: System.NullReferenceException
Message: Object reference not set to an instance of an object.
Source: Sitecore.Owin.Authentication
   at Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignIn.RemoveTicket.Process(SignInArgs args)
   at (Object , Object )
   at Sitecore.Pipelines.CorePipeline.Run(PipelineArgs args)
   at Sitecore.Pipelines.DefaultCorePipelineManager.Run(String pipelineName, PipelineArgs args, String pipelineDomain, Boolean failIfNotExists)
   at Sitecore.Pipelines.DefaultCorePipelineManager.Run(String pipelineName, PipelineArgs args, String pipelineDomain)
   at Sitecore.Owin.Authentication.Security.Cookies.DefaultCookieAuthenticationProvider.ResponseSignIn(CookieResponseSignInContext context)

I have also tried to avoid this error by aborting pipeline using patch.

        <processor type="ABC.Core.Identity.ABCSignIn, ABC.Core.Identity" resolve="true" patch:before="*" />

public override void Process(SignInArgs args)
            if (args.Context.AuthenticationType == "Cookies")
                string currentTicketId = TicketManager.GetCurrentTicketId();


It skips the pipeline but gives another error:

[ArgumentNullException: Null ids are not allowed.
Parameter name: name]
   Sitecore.Diagnostics.Assert.ArgumentNotNullOrEmpty(String argument, String argumentName) +105
   Sitecore.Security.Accounts.Account..ctor(String name, AccountType accountType) +37
   Sitecore.Security.Accounts.User..ctor(IPrincipal innerUser) +87
   Sitecore.Security.Accounts.User.FromPrincipal(IPrincipal principal) +59
   Sitecore.Pipelines.HttpRequest.BeginDiagnostics.ResolveUser() +60
   Sitecore.Pipelines.HttpRequest.BeginDiagnostics.Process(HttpRequestArgs args) +43
   (Object , Object ) +14
   Sitecore.Pipelines.CorePipeline.Run(PipelineArgs args) +484
   Sitecore.Pipelines.DefaultCorePipelineManager.Run(String pipelineName, PipelineArgs args, String pipelineDomain, Boolean failIfNotExists) +236
   Sitecore.Pipelines.DefaultCorePipelineManager.Run(String pipelineName, PipelineArgs args, String pipelineDomain) +22
   Sitecore.Web.RequestEventsHandler.OnPostAuthenticateRequest(HttpContextBase context) +214
   Sitecore.Nexus.Web.HttpModule.​‏‭‬‌‪‫‭‏‭‫​‍​‮‬‭‪‏‍​‏‫‎‮​‫‮(Object , EventArgs ) +307
   System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +223
   System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step) +213
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +91
  • 2
    Do your users need to login to the CM server? If not, configure identity server on the CM and your own startup on the CD.
    – Richard Seal
    Jan 24, 2019 at 14:59
  • 2
    My CD and CM in same machine. I am using xp0 topology.
    – Foysal
    Jan 24, 2019 at 18:08
  • 3
    Unfortunately in my case cd and cm are in same instance because of cost. Is there any way to have both?
    – Anik Saha
    Jan 24, 2019 at 18:09
  • You should be able to reference another OAuth server, just like you would reference Google or Facebook. Have you opened a ticket with support yet? I have had to open 2 so far for Identity Server.
    – Chris Auer
    Jan 25, 2019 at 13:55
  • 2
    Can you extend Sitecore.Owin.Startup to create a startup class that executes both Sitecore's and your own code?
    – Kasaku
    Aug 7, 2019 at 15:33

1 Answer 1


I found the solution. Thanks to @Kasaku

public class Startup : Sitecore.Owin.Startup
    protected override void PreInitialize(IAppBuilder app)
        JwtSecurityTokenHandler.DefaultInboundClaimTypeMap = new Dictionary<string, string>();

        app.UseCookieAuthentication(new CookieAuthenticationOptions
            CookieName = "abc.private.cookies",
            AuthenticationType = "Cookies"

        app.UseCookieAuthentication(new CookieAuthenticationOptions
            AuthenticationType = "TempCookie",
            AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive

  • This solution worked for me for site which has ADFS login. We have another site on same Sitecore where we create virtual user for login(not ADFS) is giving exception at AuthenticationManager.LoginVirtualUser(user); Exception: System.ArgumentNullException Message: Value cannot be null. Parameter name: manager Source: Microsoft.AspNet.Identity.Owin at Microsoft.AspNet.Identity.Owin.SignInManagerExtensions.SignIn[TUser,TKey](SignInManager`2 manager, TUser user, Boolean isPersistent, Boolean rememberBrowser) at Sitecore.Owin.Authentication.Security.AuthenticationManager.Login(User user)
    – AlokBhatt
    Jul 26, 2021 at 10:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.