I have the following understanding:

  1. If an unauthenticated user visits a Sitecore site virtual user is created.

  2. The name for the virtual user is a guid.

I want to understand whether it is possible that such a virtual user has either only letters or digits in the name.

Please correct me if I my understanding is wrong.

  • Sitecore doesn't create virtual users for unauthenticated visits. I believe you are confused between contact and user. In case of contacts, it does use guid as contact id. I don't think you can change the contact id to text or number. However, you can always add your own identifier to contact by calling Identify() API call. Check the below Sitecore documentation on how to identify a contact. doc.sitecore.com/xp/en/developers/102/…
    – rvsure
    Jun 1, 2022 at 0:45

1 Answer 1


I assume you are talking about virtual users: https://doc.sitecore.com/xp/en/developers/92/sitecore-experience-manager/configure-federated-authentication.html#configure-virtual-and-persistent-users

I get the same result when I login with a virtual user. If the user does not exist a unique username is generated. This is done in the following class:


This is what the decompiled class looks like for Sitecore 10.2:

using Microsoft.AspNet.Identity;
using Microsoft.AspNet.Identity.Owin;
using Sitecore.Diagnostics;
using Sitecore.Owin.Authentication.Configuration;
using Sitecore.Owin.Authentication.Identity;
using Sitecore.SecurityModel.Cryptography;
using System;
using System.Text;

namespace Sitecore.Owin.Authentication.Services
  public class DefaultExternalUserBuilder : ExternalUserBuilder
    private readonly IHashEncryption _hashEncryption;

    public DefaultExternalUserBuilder(ApplicationUserFactory applicationUserFactory, IHashEncryption hashEncryption)
      Assert.ArgumentNotNull((object) applicationUserFactory, nameof (applicationUserFactory));
      Assert.ArgumentNotNull((object) hashEncryption, nameof (hashEncryption));
      this._hashEncryption = hashEncryption;
      this.ApplicationUserFactory = applicationUserFactory;

    public bool IsPersistentUser { get; set; }

    protected ApplicationUserFactory ApplicationUserFactory { get; }

    public override ApplicationUser BuildUser(UserManager<ApplicationUser> userManager, ExternalLoginInfo externalLoginInfo)
      ApplicationUser user = this.ApplicationUserFactory.CreateUser(this.CreateUniqueUserName(userManager, externalLoginInfo));
      user.IsVirtual = !this.IsPersistentUser;
      user.Email = externalLoginInfo.Email;
      return user;

    protected virtual string CreateUniqueUserName(UserManager<ApplicationUser> userManager, ExternalLoginInfo externalLoginInfo)
      Assert.ArgumentNotNull((object) userManager, nameof (userManager));
      Assert.ArgumentNotNull((object) externalLoginInfo, nameof (externalLoginInfo));
      IdentityProvider identityProvider = this.FederatedAuthenticationConfiguration.GetIdentityProvider(externalLoginInfo.ExternalIdentity);
      if (identityProvider == null)
        throw new InvalidOperationException("Unable to retrieve an identity provider for the given identity");
      string domain = identityProvider.Domain;
      string s = externalLoginInfo.Login.LoginProvider + externalLoginInfo.Login.ProviderKey;
      string userName;
        s += "$";
        string str1 = System.Convert.ToBase64String(this._hashEncryption.ComputeHash(Encoding.ASCII.GetBytes(s))).Trim('=').Replace("/", string.Empty).Replace("+", string.Empty);
        string str2 = str1.Substring(0, Math.Min(str1.Length, 10));
        userName = domain + "\\" + str2;
      while (userManager.FindByName<ApplicationUser, string>(userName) != null);
      return userName;

As you can see the result of the CreateUniqueUserName method will return the domain with the unique username. The username is also 10 characters long.

For example I got this username after login: extranet\ahLpHAJFUy.

If you want to change this you can override the DefaultExternalUserBuilder pipeline. If you search for Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder in /sitecore/admin/showconfig.aspx you should be able to find it. You can do a config transform to override it or change it manually in \App_Config\Sitecore\Owin.Authentication\Sitecore.Owin.Authentication.config.

You can probably make a copy of the decompiled class I posted here and make your changes in that. So it should be possible to change it.

  • You could also create a new class which inherits from the DefaultExternalUserBuilder class and then override the CreateUniqueUserName method. See this blog for more info: rmcdigital.com/sitecore/… Sep 29, 2022 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.