1

In Sitecore 8.2, I had pipeline with password complexity check:

public class CheckPassword
{
    public void Process(LoggingInArgs args)
    {
        var validator = new CustomValidator();
        if(!validator.Validate(args.UserName, args.Password))
        {
            args.StartUrl = "change password url";
        }
}

Sitecore 9.1 uses OWIN authentication and as i got it doesn't use this pipeline.

So, is it possible to get check credentials of user before they will be logged in?

1

Sitecore uses Owin authentication, so you could probably do similar thing by using this "owin.cookieAuthentication.signIn" pipeline instead of "loggingin" pipeline

The config file is located at App_Config\Sitecore\Owin.Authentication\Sitecore.Owin.Authentication.config

Your patch could look something like this...

<owin.cookieAuthentication.signIn>
        <processor resolve="true" type="Namespace.CheckPassword, AssemblyName" patch:after="processor[@type='Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignIn.RemoveTicket, Sitecore.Owin.Authentication']" />
</owin.cookieAuthentication.signIn>

Your codes could be something like this (I have not tested this)

public class CheckPassword : SignInProcessor
{
    public void Process(SignInArgs args)
    {
        var validator = new CustomValidator();
        if(!validator.Validate(args))
        {
            args.Success = false;
            args.HttpContext.Response.Redirect("change password url");
            args.AbortPipeline();
        }
}

  • Sorry, added more information in question. Previously i was able to validate credentials with membership provider. SignInArgs class doesn't have Password of the user, so I am not able to validate credentials – Mickey P Apr 4 '19 at 10:16
  • I didn't found any suitable owin pipelines for this purpose. Alternatively you might consider disabling identity server doc.sitecore.com/developers/91/sitecore-experience-management/… – Fredric Foo Apr 5 '19 at 2:54
  • I decided to avoid this pipeline at all. Custom MembershipProvider will use same validator and it is possible to force users to change password once, thank you. – Mickey P Apr 5 '19 at 13:43
1

I stumbled on this one and did get some pointers to debug my work further, like you I was struggling to add pipeline hooks at correct location. Found the answer in this SO question.

I had tried two actions, on successful SignIn and once SignedIn, unfortunately both are triggering on initial login and I am trying to find answer to trigger on auto login via cookie or just refresh of page. Happy searching....

Here is my patch file:

<?xml version="1.0" encoding="utf-8"?>
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
  <sitecore>
    <pipelines>
      <owin.cookieAuthentication.signIn>
        <processor resolve="true" type="CMS.Logging.CheckOnSignIn, CMS" 
                   patch:after="processor[@type='Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignIn.UpdateUserProperties, Sitecore.Owin.Authentication']" />
      </owin.cookieAuthentication.signIn>
      <owin.cookieAuthentication.signedIn>
        <processor resolve="true" type="CMS.Logging.CheckOnSignedIn, CMS"
                   patch:before="processor[@type='Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.CreateTicket, Sitecore.Owin.Authentication']" />
      </owin.cookieAuthentication.signedIn>
    </pipelines>
  </sitecore>
</configuration>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.