How can we replace the existing membership provider in Sitecore with an OAuth- based provider (like stormpath.com)?

Further details: We are designing a solution in which the external users are stored in an external system instead of the build-in membership database. The authentication is to be handled via stormpath (stormpath.com) using the OAuth token-based authentication they provide, but we are unsure how to change the default membership provider in Sitecore to use the OAuth methods provided by Stormpath (or similar OAuth-provider).

Any suggestions on how to solve this issue?

We have played around with the VirtualLogin feature of Sitecore, which in combination with custom login/logout methods could be used to some extend. However, this introduces an additional authentication cookie instead of the JWT-token issued by the OAuth provider (as far as we can see).

  • Are you fixed on Stormpath? There is a ready to use Sitecore module for Gigya which, as far as I know, ticks the same boxes. marketplace.sitecore.net/Modules/G/GigyaSitecore_Connector.aspx
    – Mark Cassidy
    Jan 6, 2017 at 15:08
  • Not necessarily, I will take a look at Gigya.
    – pwind
    Jan 6, 2017 at 15:13
  • 1
    When i am implementing a SSO solution, I prefer to use a Virtual User. It requires minimal work on the implementation side as I can completely rely on the third party provider for authentication via API. Using an OAuth provider or creating a custom membership provider may bring in too much complexity. Even with using an OAuth provider, you will still need to store the token somewhere, Session, cookie, etc...
    – C Sigmon
    Jan 6, 2017 at 19:36

1 Answer 1


If there is not already a Sitecore Module that handles the specific OAuth provider, you can manually setup it up by:

  1. Redirect the user to the oAuth2 authentication screen
  2. Have the ID provider (IDP) validate and authenticate the user
  3. The ID provider will return back to Sitecore an authorization token, most likely containing a list of claims
  4. In code (potentially in a custom HttpBeginRequest pipeline processor) log the user in as a Virtual User, then assign predefined Sitecore roles to the virtual user based on mapping the claims provided from the IDP to the user

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.