I created a few pages within our Sitecore setup to be accessed only by the Sitecore administrator while our site was still running on 8.2, using


to check if the user was an administrator or not on the controller level. After upgrading to Sitecore 9.1 the same line of code does not work anymore and is always returning false due to the user now being seen as


Is there any way I can get the correct logged in user? as I suspect this has something to do with identityserver.

Edit: these pages are like Sitecore admin pages, but instead of creating aspx pages and storing them under the sitecore\admin folder in the webroot, they are Sitecore items built using MVC and are saved under the main Sitecore tree.

The process into navigating to them would be like this:

1- Sitecore admin log's into Sitecore

2- Sitecore admin navigates to the following URL: https://hostname/securepages/mysecurepage

and can view the page.

  • Sitecore.Context.User.Name 100% still works in 9.1 for a normal login via AuthenticationManager.Login(accountName, password, rememberMe);
    – Chris Auer
    Commented Mar 17, 2019 at 12:07
  • I'm not logging into these pages, I'm a sitecore admin who is already logged in and then navigates to these pages, which are within the tree of the main site under the home item
    – Muradious
    Commented Mar 17, 2019 at 12:09
  • So you are trying to use this code while in the Sitecore Content Editor?
    – Chris Auer
    Commented Mar 17, 2019 at 12:13
  • while logged in, but not from the content editor, I added a few edits to the original question to add more detail to the flow
    – Muradious
    Commented Mar 17, 2019 at 12:16
  • 3
    Definitely some funk with Identity Server. The following was required for the Unicorn Control Panel. github.com/SitecoreUnicorn/Unicorn/blob/master/src/Unicorn/… Wasn't me who came up with this however, so I'm not 100% up to speed of why this works and what it does to Identity Server.
    – Mark Cassidy
    Commented Mar 17, 2019 at 21:13

1 Answer 1


In 9.1, you need to patch in the path of your custom admin pages to the list of the siteNeutralPaths for the ValidateSiteNeutralPaths processor in the owin.cookieAuthentication.validateIdentity pipeline like so:

        <processor type="Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.ValidateIdentity.ValidateSiteNeutralPaths, Sitecore.Owin.Authentication">
          <siteNeutralPaths hint="list">
            <!-- You could get as specific as /securepages/mysecurepage for the path if you don't have any other pages under the /securepages path. -->
            <path hint="securepages">/securepages</path>

If you look at the ValidateSiteNeutralPaths processor on /sitecore/admin/showconfig.aspx, Sitecore has provided an explanation for why this is needed (taken from 9.1 Initial Release):

There are scenarios when some URIs are resolved with the website context, but should be executed within the shell context instead.

Example: /sitecore/api/ssc/ListManagement/List/Recent?pageSize=6&pageIndex=1&payLoad=full&language=en&searchExpression=&sc_lang=en

If an external identity provider is configured to only be used with the shell site, we must be able to use a user from that provider to make the authorized request. Use this processor to specify these paths.

Note: if you need to omit the execution of this processor for some URIs (e.x. for API requests from website on CM), add the sc_site=... query parameter to the requested URI.

  • Is there any reason this would not work? I am doing this similarly for Unicorn and have the patch installed for the /unicorn.aspx URL, but am still allowed to browse to it anonymously. Commented Mar 10, 2021 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.