After upgrading to Sitecore 9.3, some times, users are not able to log in to Content Delivery (using ADFS) because we're exceeding the maximum editor's restriction by license. It's weird because is Content Delivery. The error I'm seeing in logs is:

The maximum number of simultaneously active (logged-in) editors exceeded. The User extranet\xxxx cannot be logged in to the system. The maximum of editors allowed by license is 10.

The user is then redirected to /sitecore/client/Applications/LicenseOptions/StartPage but is throwing 404 error, obviously, because it is Content Delivery site.

  • what domain are your users created under? – Richard Seal Feb 20 at 16:41
  • @RichardSeal the users are created under extranet. Actually the error in logs says: The User extranet\xxxx cannot be logged in to the system. – Johnny Lopez Feb 20 at 16:43
  • what Sitecore Site are the users being authenticated against? – Mark Cassidy Feb 20 at 16:50
  • @MarkCassidy We're using external ADFS login, so the users are redirected to login first with ADFS and then redirected to "/sitecore/client/Applications/LicenseOptions/StartPage" (the usual pre-Kick user page). Ideally should be redirected to redirectUrl. – Johnny Lopez Feb 20 at 16:51
  • Read my question. When hooking up federated authenticated, you tie this to a site. Which site are you using? – Mark Cassidy Feb 20 at 16:52

This is the support help I got and fixed it: Could you please try overriding the CheckDomainGuard processor using the following:

namespace CustomNamespace
    public class CustomCheckDomainGuard : Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.CheckDomainGuard
        public CustomCheckDomainGuard(BaseLog log) : base(log)


        public override void Process(SignedInArgs args)
            if (string.Equals(args.Site.Name, Sitecore.Constants.ShellSiteName, StringComparison.Ordinal))

Then please use a patch file containing the following to patch it in:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:set="http://www.sitecore.net/xmlconfig/set/">
                <processor type="Sitecore.Owin.Authentication.Pipelines.CookieAuthentication.SignedIn.CheckDomainGuard, Sitecore.Owin.Authentication" patch:instead="*[@type='CustomNamespace.CustomCheckDomainGuard, CustomAssembly']" resolve="true" />
| improve this answer | |

Sitecore support has registered this a bug with reference number 366550, and there is a hotfix available for 9.2 and 9.3 here.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.