We are integrating identity server authentication using Owin to a Sitecore 6.6 MVC application.

After successful authentication Im trying to login a Sitecore virtual user which seems not persisted to session and not fetching authenticated Sitecore user in next request.

here is the code where I'm creating virtual user

  if (httpContext.Request.LogonUserIdentity != null && httpContext.Request.LogonUserIdentity.IsAuthenticated)
            if (!Sitecore.Context.User.IsAuthenticated)
                var ticket = IdentityHelper.GetAuthenticationKeyTicket();
                var username = ticket.Identity.Claims.Where(x => x.Type == "subject").Select(c => c.Value).FirstOrDefault();
                var id = ticket.Identity.Claims.Where(x => x.Type == "id").Select(c => c.Value).FirstOrDefault();

                var usernamewithdomain = $"domain\\{username}";

                var scUser = Sitecore.Security.Authentication.AuthenticationManager.BuildVirtualUser(usernamewithdomain, true);
                scUser.Profile.FullName = usernamewithdomain;
                scUser.Profile.SetCustomProperty("number", id);
                if (Sitecore.Security.Authentication.AuthenticationManager.LoginVirtualUser(scUser))
                    WebUtil.Redirect(httpContext.Request.QueryString["returnUrl"] ?? "/");

after this, Sitecore.Context.User.IsAuthenticated is true for that particular request, and is lost once redirected to another page.

What am I missing here.


The Virtual user works as intended, before Owin middleware challenges authentication and creates a auth cookie(issued by Owin Security Cookie middleware).

The problem occurs when Sitecore.Security.Authentication.AuthenticationManager.Login/LoginVirtualUser is invoked after Owin authentication cookie is issued.

Can this be some Owin middleware pipeline restricting the Forms Authentication cookie issued by Sitecore Authentication Model?

  • Please check VirtualUserLogin method at github.com/AmitKumar-AK/CT.SC/blob/master/src/Feature/Accounts/…. With this code Sitecore.Context.User.IsAuthenticated will return true.
    – Amit Kumar
    Oct 28, 2019 at 8:27
  • @AmitKumar - how is this code different from the code in Quetsion? anyways I tried the code in link, yet Sitecore.Context.User.IsAuthenticated is true for that request, but lost in the next request..
    – nari447
    Oct 28, 2019 at 8:44
  • I tried it in one of the implementation n was working fine. In this case you can set one session object and check that..
    – Amit Kumar
    Oct 28, 2019 at 8:47
  • Can you try moving "scUser.Profile.Save();" after roles have been added.
    – josedbaez
    Oct 28, 2019 at 21:48
  • @josedbaez - tried and no luck. I've updated the question with more findings. Please have a look.
    – nari447
    Oct 29, 2019 at 5:31


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.