In my project, I have to add a login system for users using a different database. These users will not have access to the sitecore functionality, only those with anonymous access. Any ideas how I can hook up such a login system? An additional controller that will manage the session?
2
-
Are you saying that your site needs to support authentication to view Sitecore content?– sitecorerickSep 25, 2017 at 18:58
-
Yes, additional authentication (external, I only get information from another site to create a session) is needed to see content normally visible to anonymous users– JanSep 25, 2017 at 19:41
Add a comment
|
3 Answers
You can use a virtual user to accomplish this. This blog from briancaos explains you exactly how.
A virtual User is (as the word says) a memory-only Sitecore user that is created "on the fly". Once you have authorized your user (custom code for your login system), you can create a virtual user that Sitecore will recognize as a normal user.
var user = Sitecore.Security.Authentication.AuthenticationManager.BuildVirtualUser("extranet\\[email protected]", true);
// You can add roles to the Virtual user
user.Roles.Add(...);
// Login the virtual user
Sitecore.Security.Authentication.AuthenticationManager.LoginVirtualUser(user);
You can also make UserResolver processor in httpRequestBegin pipeline to modify the default behaviour. You can override UserResolver to perform authentication using different database as you mentioned above in your question.
Class: Sitecore.Pipelines.HttpRequest.UserResolver Assembly: Sitecore.Kernel
This processor determines the current request’s user account. Sets up Sitecore.Context.User property.
Below link might help. http://www.letsdositecore.com/sitecore-pipeline-processor-with-httpcontext-current-session/
If all of your externally authenticated users will have access to the same Sitecore content, you could create a single "authenticated" user in the Extranet domain and then, upon authorizing to your external system, log the "authenticated" user in via the Sitecore Security API. This is the "impersonation" strategy, similar to what IIS and ASP.NET have done for years.
