I am migrating an app from Sitecore 8 to 10. The existing app was built with .Net 4.6.1 and uses Microsoft AspNet Identity and Owin for user access.

The Startup class uses the OwinStartupAttribute annotation:

[assembly: OwinStartupAttribute(typeof(Application.Web.Startup))]

And the Startup class includes setting up the user and signin managers:


After migrating to Sitecore 10.1.1 and attempting to login to the app as was done previously, the call to find a user by email fails with:

System.ArgumentNullException: Value cannot be null.
Parameter name: manager
   at Microsoft.AspNet.Identity.UserManagerExtensions.FindByEmail[TUser,TKey](UserManager`2 manager, String email)

I see in appSettings that Sitecore 10 is now registering it's own Owin Startup:

<add key="owin:appStartup" value="Sitecore.Owin.Startup, Sitecore.Owin" />

I have found that if I comment this out of appSettings, the user application's login works just fine; but Sitecore's admin login no longer works. And if I leave it in appSettings, the opposite is true - Sitecore's Admin login works and the user application's login fails with the error above.

I haven't had much success in finding how to integrate so that both logins can work independently with their own separate stores and login screens like it was working in Sitecore 8. The Sitecore 10 that we are deploying to will be using the newer Sitecore Identity. Is there a good reference for doing this?

  • I am facing the same problem, did you find a solution for this? May 17, 2022 at 20:54
  • 1
    @AbdulrahmanAwwad - This is still in our backlog to address. But some initial research leads me to believe that we will have to integrate with Sitecore Identity with a virtual user. Sorry I don't have more at the moment, but I would probably search "sitecore virtual user" and read on that.
    – fgantt
    May 19, 2022 at 15:44
  • I found a solution for this will post it as an answer. May 20, 2022 at 17:59

3 Answers 3


As already mentioned by Mark the best way is to use configuration from Sitecore.

Keep in mind the following parts:

  • IdentityProvidersProcessor -- here you can set your authentication settings and configure your app to use the specific authentication like: args.App.UseGoogleAuthentication(googleAuthOptions);
  • AuthenticationMiddleware - you can use Nuget packages like Microsoft.Owin.Security.Google

Optional you if you have a custom claim that needs to be linked for a user as identifier you can use Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, here you can override the CreateUniqueUserName.


try the following:

Remove owin:appStartup setting from web.config

<add key="owin:appStartup" value="Sitecore.Owin.Startup, Sitecore.Owin" />

Add the OwinStartupAttribute annotation

[assembly: OwinStartupAttribute(typeof(Application.Web.Startup))]

Change the startup class as

public class Startup : Sitecore.Owin.Startup
        public new void Configuration(IAppBuilder app)

The recommended approach is to follow the Configure federated authentication guide to implement your identity provider.

Sitecore's Owin extensions are actually quite powerful and are designed to add multiple ways to authenticate, on a per site basis, all via configuration.

One thing to note that isn't covered in the documentation there, is that for Sitecore to know that a user is a virtual user, you need to set the following Claim:

<claim name="http://www.sitecore.net/identity/claims/shadowuser" value="true" />

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.