After upgrading to Sitecore 9.3, some times, users are not able to log in to Content Delivery (using ADFS) because we're exceeding the maximum editor's restriction by license. It's weird because is Content Delivery. The error I'm seeing in logs is:

The maximum number of simultaneously active (logged-in) editors exceeded. The User extranet\xxxx cannot be logged in to the system. The maximum of editors allowed by license is 10.

The user is then redirected to /sitecore/client/Applications/LicenseOptions/StartPage but is throwing 404 error, obviously, because it is Content Delivery site.

  • what domain are your users created under?
    – Richard Seal
    Commented Feb 20, 2020 at 16:41
  • @RichardSeal the users are created under extranet. Actually the error in logs says: The User extranet\xxxx cannot be logged in to the system. Commented Feb 20, 2020 at 16:43
  • what Sitecore Site are the users being authenticated against?
    – Mark Cassidy
    Commented Feb 20, 2020 at 16:50
  • @MarkCassidy We're using external ADFS login, so the users are redirected to login first with ADFS and then redirected to "/sitecore/client/Applications/LicenseOptions/StartPage" (the usual pre-Kick user page). Ideally should be redirected to redirectUrl. Commented Feb 20, 2020 at 16:51
  • Read my question. When hooking up federated authenticated, you tie this to a site. Which site are you using?
    – Mark Cassidy
    Commented Feb 20, 2020 at 16:52

2 Answers 2


This is the support help I got and fixed it: Could you please try overriding the CheckDomainGuard processor using the following:

namespace CustomNamespace
    public class CustomCheckDomainGuard : Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.CheckDomainGuard
        public CustomCheckDomainGuard(BaseLog log) : base(log)


        public override void Process(SignedInArgs args)
            if (string.Equals(args.Site.Name, Sitecore.Constants.ShellSiteName, StringComparison.Ordinal))

Then please use a patch file containing the following to patch it in:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:set="http://www.sitecore.net/xmlconfig/set/">
                <processor type="Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.CheckDomainGuard, Sitecore.Owin.Authentication" patch:instead="*[@type='CustomNamespace.CustomCheckDomainGuard, CustomAssembly']" resolve="true" />
  • This worked for us also! +1. However, just note that you have the patch the other way around it should be: <processor type="CustomNamespace.CustomCheckDomainGuard, CustomAssembly" patch:instead="*[@type='Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.CheckDomainGuard, Sitecore.Owin.Authentication']" resolve="true" /> Commented Aug 12, 2022 at 5:57

Sitecore support has registered this a bug with reference number 366550, and there is a hotfix available for 9.2 and 9.3 here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.