I am setting up sitecore identity server to pass through authentication to Okta for some of our portals. However some of our portals already have a manual authentication approach taken which logs in the virtual user using the AuthenticationManager. When I enable Sitecore Identity server this code fails when trying to login the virtual user.

Is there something I can do to workaround this issue or do I need to change these over to be handled by the identity server?

My guess is that Sitecore now wants the identity server to authenticate the user and will not do it internally any more.

Any help is appreciated.


If I use the following instead:

var providerHelper = Sitecore.DependencyInjection.ServiceLocator.GetRequiredResetableService<ProviderHelper<AuthenticationProvider, AuthenticationProviderCollection>>();
var user = providerHelper.Value.Provider.BuildVirtualUser(username, true);

The code seems to work but then fails at a later unrelated section of code. No idea why this is happening, any suggestions would be appreciated.

Below is the code we are running to login in the user (I have removed a lot of the boilerplate). It is running in a custom sitecore pipeline

<processor type="MLCGP.Security.Feature.Pipelines.OAuthSignInCallback,MLCGP.Security.Feature" patch:before="processor[@type='Sitecore.Pipelines.HttpRequest.UserResolver, Sitecore.Kernel']" >

namespace MLCGP.Security.Feature.Pipelines
    public class OAuthSignInCallback : HttpRequestProcessor
        public override void Process(HttpRequestArgs args)
            var idToken = args.HttpContext.Request.Form["id_token"];
            LoggedInUserInfo claims = null;
                log.Debug($"calling ValidateOpenIdIdentityToken for domain '{Settings.MemberDomain}'", this);
                // Validate token and construct claims prinicpal / session security token
                claims = oktaService.ValidateOpenIdIdentityToken(idToken, Settings.MemberDomain);
            var user = UserHelper.CreateMemberUser(claims);

public static User CreateMemberUser(LoggedInUserInfo loggedInUserInfo)
    var claimsProcessor = new OpenIdClaimsMapper();
    var userClaims = claimsProcessor.Map(loggedInUserInfo);
    var username = loggedInUserInfo.UserName;

    var providerHelper = Sitecore.DependencyInjection.ServiceLocator.GetRequiredResetableService<ProviderHelper<AuthenticationProvider, AuthenticationProviderCollection>>();
    //var user = AuthenticationManager.BuildVirtualUser(username, true);

    var user = providerHelper.Value.Provider.BuildVirtualUser(username, true);

    AssignUserRoles(user, userClaims, loggedInUserInfo.Domain);

    return user;
  • Can you share the code you are using to login the virtual user? Also the error messages that are given when the code fails? Commented Sep 25, 2023 at 16:17
  • Also what version of sitecore? If after 9.1 SI is enabled by default, so were you disabling previously using disabler from example config? Commented Sep 25, 2023 at 16:24
  • We are using Sitecore 9.3, we were disabling using the disabler config. See above for updates on the code that we are running Commented Sep 26, 2023 at 23:46
  • Thanks for the update - please confirm the errors you are recieving Commented Sep 27, 2023 at 6:46
  • At the moment using the manual fetching for the Auth provider login is working, its just logout now that is causing issues, no errors are thrown but the user object has IsAuthenticated as true even after logout method is called. I have even replaced the AuthenticationManager.Logout() with the ServiceLocator version of logout to no avail Commented Sep 28, 2023 at 4:28

1 Answer 1


Im wondering if it is something to do with the way you are enabling/disabling identityserver?

Assuming you are using code similar to the below to log the virtual user:

User virtualUser = Sitecore.Security.Authentication.AuthenticationManager.BuildVirtualUser("extranet\\[email protected]", true);

Instead, please can you try a slighty different approach

YourConstructor(ProviderHelper<AuthenticationProvider, AuthenticationProviderCollection> providerHelper)
    User virtualUser = providerHelper.Provider.BuildVirtualUser("extranet\\[email protected]", true);

Note: if you decompile the sitecore.kernel dll, you can see that a similar thing is happening when you call Sitecore.Security.Authentication.AuthenticationManager. First of all, it checks to see which dependency is registered for BaseAuthenticationManager (which is DefaultAuthenticationManager). That class accesses the dependency shown above in the same way to get a providerHelper, and from that selects the default Provider (which in this case is Forms I believe).

If you then put a break point in the code and inspect what the provider is in both cases (which should be 'Forms'). Im wondering if the config you are applying is disabling this somehow when enabling identity server?

I just tried logging in a virtual user, using the approach shown here: https://www.kasaku.co.uk/2017/11/22/virtual-user-custom-properties/

Both with and without identity server enabled, I was able to see the virtual user shown as the Sitecore.Context.User on subsequent calls.

  • OK - Is the value of providerHelper.Value.Provider the same with and without identity server enabled? Please provide any logs of failures. How are you enabling/disabling ID server? Commented Sep 26, 2023 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.