2

We are integrating identity server authentication using Owin to a Sitecore 6.6 MVC application.

After successful authentication Im trying to login a Sitecore virtual user which seems not persisted to session and not fetching authenticated Sitecore user in next request.

here is the code where I'm creating virtual user

  if (httpContext.Request.LogonUserIdentity != null && httpContext.Request.LogonUserIdentity.IsAuthenticated)
        {
            if (!Sitecore.Context.User.IsAuthenticated)
            {
                var ticket = IdentityHelper.GetAuthenticationKeyTicket();
                var username = ticket.Identity.Claims.Where(x => x.Type == "subject").Select(c => c.Value).FirstOrDefault();
                var id = ticket.Identity.Claims.Where(x => x.Type == "id").Select(c => c.Value).FirstOrDefault();

                var usernamewithdomain = $"domain\\{username}";

                var scUser = Sitecore.Security.Authentication.AuthenticationManager.BuildVirtualUser(usernamewithdomain, true);
                scUser.Profile.FullName = usernamewithdomain;
                scUser.Profile.Save();
                scUser.Profile.SetCustomProperty("number", id);
                scUser.Roles.Add(Role.FromName("domain\\authenticated"));
                if (Sitecore.Security.Authentication.AuthenticationManager.LoginVirtualUser(scUser))
                {
                    WebUtil.Redirect(httpContext.Request.QueryString["returnUrl"] ?? "/");
                }
            }
        }

after this, Sitecore.Context.User.IsAuthenticated is true for that particular request, and is lost once redirected to another page.

What am I missing here.

Update:

The Virtual user works as intended, before Owin middleware challenges authentication and creates a auth cookie(issued by Owin Security Cookie middleware).

The problem occurs when Sitecore.Security.Authentication.AuthenticationManager.Login/LoginVirtualUser is invoked after Owin authentication cookie is issued.

Can this be some Owin middleware pipeline restricting the Forms Authentication cookie issued by Sitecore Authentication Model?

  • Please check VirtualUserLogin method at github.com/AmitKumar-AK/CT.SC/blob/master/src/Feature/Accounts/…. With this code Sitecore.Context.User.IsAuthenticated will return true. – Amit Kumar Oct 28 '19 at 8:27
  • @AmitKumar - how is this code different from the code in Quetsion? anyways I tried the code in link, yet Sitecore.Context.User.IsAuthenticated is true for that request, but lost in the next request.. – nari447 Oct 28 '19 at 8:44
  • I tried it in one of the implementation n was working fine. In this case you can set one session object and check that.. – Amit Kumar Oct 28 '19 at 8:47
  • Can you try moving "scUser.Profile.Save();" after roles have been added. – josedbaez Oct 28 '19 at 21:48
  • @josedbaez - tried and no luck. I've updated the question with more findings. Please have a look. – nari447 Oct 29 '19 at 5:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.