We have managed to configure our Auth0 custom identity provider in our solution. Migrating from forms authentication however will take a bit more effort than just a bunch of config.

In order to avoid a really long lived branch, would there be a possibility to switch federated security on/off using a feature switch service like Launch Darkly.

Example of config:

<?xml version="1.0" encoding="utf-8"?>

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/" xmlns:set="http://www.sitecore.net/xmlconfig/set/">
    <!--    This configuration disables Owin and Federated Auth which prevents Sitecore Membership Provider
            from allow website visitors to authenticate and maintain a authenticated session. 
            This only applies to Standalone used for local dev and ContentDelivery for public website. 
            The CMS will still use Sitecore Identity Server to Authenticate. -->
     <sitecore role:require="Standalone or ContentDelivery">
            <setting name="Owin.Authentication.Enabled" value="false" />
            <setting name="FederatedAuthentication.Enabled" value="false" />

            <site name="shell" set:loginPage="/sitecore/login" />
            <site name="admin" set:loginPage="/sitecore/admin/login.aspx" />

Where the flags like Owin.Authentication.Enabled can be switched on to True at runtime by fetching this from another service.

1 Answer 1


There are 2 different parts to this questions:

  1. Updating the Sitecore config at runtime is possible but hard, see this post for more details. However:
  2. I don't believe succeeding in task 1 will actually help you. The OWIN middleware used by FederatedAuthentication gets registered when the Application Pool starts. The middleware is already registered if you change the setting at runtime later. This middleware cannot be removed later see this.

I would suggest looking into one of below approaches:

  1. If the main goal is about preventing a long lived branch, then perhaps you merge and delete this branch but keep Owin.Authentication.Enabled disabled until you are ready to introduce this change (which will require a deployment)?
  2. If above option does not work for your scenario, then you could look into the approach which is also linked here about wrapping the execution of the middleware with a condition. This might require a lot of customizations to Sitecore as some of the middleware is registered by Sitecore.
  • Thanks! That is helpful and validates some of the assumptions I had about the config initialisation. We'll just have to have different config transformations for our staging environment. Mar 10, 2022 at 1:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.