3

I am trying to login a virtual user for my application and have assigned roles to this virtual user.

var virtualUser = Sitecore.Security.Authentication.AuthenticationManager.BuildVirtualUser(userName, true);
Sitecore.Security.Accounts.Role itemRole = Sitecore.Security.Accounts.Role.FromName(role.ToLower());
virtualUser.Roles.Add(itemRole);
Sitecore.Security.Authentication.AuthenticationManager.LoginVirtualUser(virtualUser);

Now I want to logout from this Virtual User so I have used

Sitecore.Security.Authentication.AuthenticationManager.Logout();

It works fine until here.. but when I login to this virtual user again. It persists the roles that were previously assigned to it. how can I remove assigned roles from the virtual user before I log the user out? I have tried removing all roles before logout but that didn't work.

Sitecore.Context.User.Roles.RemoveAll();
Sitecore.Security.Authentication.AuthenticationManager.Logout()

Other approaches I have tried which didn't work.

var virtualuser = Sitecore.Security.Authentication.AuthenticationManager.GetActiveUser();
Sitecore.Security.Authentication.AuthenticationManager.Logout();
virtualUser.Delete();

and

Sitecore.Security.Authentication.AuthenticationManager.Logout();
HttpContext.Current.Session.Abandon();

What should be done to remove roles and logout the virtual user?

Update: I am using extranet\authenticated as the username to login as a virtual user. Could this be causing the issue. Sitecore Version 9.0.2

1

I was able to achieve this by adding below code.

            var virtualUser = Sitecore.Security.Authentication.AuthenticationManager.GetActiveUser();
            virtualUser.RuntimeSettings.AddedRoles.Clear();
            virtualUser.Roles.RemoveAll();
            virtualUser.RuntimeSettings.Save();
            Sitecore.Security.Authentication.AuthenticationManager.Logout();

Apparently VirtualUser properties and roles are stored in ClientData table which does not clear added roles until you use virtualUser.RuntimeSettings.Save() to update the ClientData table.

0

Sitecore does not clear virtual users after logout. To over come this, you can remove the virtual user roles before logout

var virtualUser = Sitecore.Security.Authentication.AuthenticationManager.GetActiveUser();

// Remove roles here from virtualUser

Sitecore.Security.Authentication.AuthenticationManager.Logout(); virtualUser.User.Delete();
7
  • what is VirtualUser in this case? – Shaurya Feb 1 at 12:30
  • Updates the answer – Mahesh Raghupathi Feb 1 at 12:45
  • I was not able to find virtualUser.Logout(). I tried virtualUser.Delete() but that didn't work. – Shaurya Feb 1 at 14:46
  • @Shaurya did this work for you? You should still use the call Sitecore.Security.Authentication.AuthenticationManager.Logout() to logout. – Julius A Feb 1 at 17:05
  • @Shaurya I don't have access to the code base to give you exact code, but you can try the following, Sitecore.Security.Authentication.AuthenticationManager.Logout(); virtualUser.User.Delete(); – Mahesh Raghupathi Feb 1 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.