1

In Sitecore 8.2, I had pipeline with password complexity check:

public class CheckPassword
{
    public void Process(LoggingInArgs args)
    {
        var validator = new CustomValidator();
        if(!validator.Validate(args.UserName, args.Password))
        {
            args.StartUrl = "change password url";
        }
}

Sitecore 9.1 uses OWIN authentication and as i got it doesn't use this pipeline.

So, is it possible to get check credentials of user before they will be logged in?

1

Sitecore uses Owin authentication, so you could probably do similar thing by using this "owin.cookieAuthentication.signIn" pipeline instead of "loggingin" pipeline

The config file is located at App_Config\Sitecore\Owin.Authentication\Sitecore.Owin.Authentication.config

Your patch could look something like this...

<owin.cookieAuthentication.signIn>
        <processor resolve="true" type="Namespace.CheckPassword, AssemblyName" patch:after="processor[@type='Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignIn.RemoveTicket, Sitecore.Owin.Authentication']" />
</owin.cookieAuthentication.signIn>

Your codes could be something like this (I have not tested this)

public class CheckPassword : SignInProcessor
{
    public void Process(SignInArgs args)
    {
        var validator = new CustomValidator();
        if(!validator.Validate(args))
        {
            args.Success = false;
            args.HttpContext.Response.Redirect("change password url");
            args.AbortPipeline();
        }
}

  • Sorry, added more information in question. Previously i was able to validate credentials with membership provider. SignInArgs class doesn't have Password of the user, so I am not able to validate credentials – Mickey P Apr 4 at 10:16
  • I didn't found any suitable owin pipelines for this purpose. Alternatively you might consider disabling identity server doc.sitecore.com/developers/91/sitecore-experience-management/… – Fredric Foo Apr 5 at 2:54
  • I decided to avoid this pipeline at all. Custom MembershipProvider will use same validator and it is possible to force users to change password once, thank you. – Mickey P Apr 5 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.