2

In my project, I have to add a login system for users using a different database. These users will not have access to the sitecore functionality, only those with anonymous access. Any ideas how I can hook up such a login system? An additional controller that will manage the session?

  • Are you saying that your site needs to support authentication to view Sitecore content? – Sergeant Sitecore Sep 25 '17 at 18:58
  • Yes, additional authentication (external, I only get information from another site to create a session) is needed to see content normally visible to anonymous users – Jan Sep 25 '17 at 19:41
3

You can use a virtual user to accomplish this. This blog from briancaos explains you exactly how.

A virtual User is (as the word says) a memory-only Sitecore user that is created "on the fly". Once you have authorized your user (custom code for your login system), you can create a virtual user that Sitecore will recognize as a normal user.

var user = Sitecore.Security.Authentication.AuthenticationManager.BuildVirtualUser("extranet\\user@yourdomain.com", true);

// You can add roles to the Virtual user
user.Roles.Add(...);

// Login the virtual user
Sitecore.Security.Authentication.AuthenticationManager.LoginVirtualUser(user);
1

You can also make UserResolver processor in httpRequestBegin pipeline to modify the default behaviour. You can override UserResolver to perform authentication using different database as you mentioned above in your question.

Class: Sitecore.Pipelines.HttpRequest.UserResolver Assembly: Sitecore.Kernel

This processor determines the current request’s user account. Sets up Sitecore.Context.User property.

Below link might help. http://www.letsdositecore.com/sitecore-pipeline-processor-with-httpcontext-current-session/

0

If all of your externally authenticated users will have access to the same Sitecore content, you could create a single "authenticated" user in the Extranet domain and then, upon authorizing to your external system, log the "authenticated" user in via the Sitecore Security API. This is the "impersonation" strategy, similar to what IIS and ASP.NET have done for years.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.