17 votes
Accepted

Does Sitecore support SAML?

This will be natively supported in Sitecore 9.0, according to the public roadmaps. For now a solution might be to use this module: https://github.com/BasLijten/SitecoreFederatedLogin See my blog on ...
Bas Lijten's user avatar
  • 1,857
12 votes

Does Sitecore support SAML?

It might. There is a company claiming to have an option for it, but there is no direct download link and no way to easily verify the claim. https://www.ssoeasy.com/sitecore-sso/ That said; you might ...
Mark Cassidy's user avatar
  • 25.2k
9 votes

Does Sitecore support SAML?

1) Sitecore 9+ natively supports SAML through Federated Authentication. You have to configure it and write your own provider. These links will guide you through this process for Sitecore 9: Usage in ...
Peter Procházka's user avatar
9 votes
Accepted

How to implement forgot password feature in any Sitecore application

Disclosure: answer taken from Securing the password recovery experience in Sitecore 8 by Anders Laub Christofferson First we do some configuration re-organizing. We copy paste the old ...
Andrei Paliakou's user avatar
7 votes
Accepted

Experience Editor Timeout change

They are all slightly different things and do not necessarily need to be in sync: <forms name=".ASPXAUTH" cookieless="UseCookies" timeout="20" /> Is a Forms Timeout and is the length in time ...
vandsh's user avatar
  • 1,651
6 votes

Architecture choices for integrating Azure AD with Sitecore

I cannot give you a detailed answer but you should know that in the future (not yet scheduled) the AD module will be retired and Sitecore will move away from the Microsoft Membership model and towards ...
Tamas Varga Sitecore's user avatar
6 votes
Accepted

Is Virtual user concept available in XM version?

Yes, you can use virtual users in XM: Sitecore also supports Virtual Users, which is a transient user account system that you can use, for example, when integrating with custom authentication ...
Jason St-Cyr's user avatar
  • 6,781
6 votes

How to authenticate users with on JSS application?

With Next.js, you can use a tool like NextAuth.js to add authentication. NextAuth.js has providers for Azure Active Directory and Azure Active Directory B2C. This would be enabled for your rendering ...
Richard Seal's user avatar
  • 20.4k
5 votes
Accepted

Authentication and Authorization in Sitecore

I am afraid this question is quite extensive. Sitecore uses ASP.NET membership, role and profile providers. As a starting place, please check this Security API Cookbook. This will give you a ...
Leonardo Cunha's user avatar
5 votes
Accepted

Share Session across Sitecore subsites

You can use SSO software to treat all of the sites as part of a single 'authentication' realm. That way you log in once and then each site pings back to your SSO software to get the token or ...
Jason St-Cyr's user avatar
  • 6,781
5 votes
Accepted

PostLogoutRedirectUri with Owin and Azure ADb2C

Probably might help someone. I managed to figure this out as the issue was on the Controller Action for SignOut. Sitecore handles the Owin Middleware integration little differently from Asp.NET. ...
Abhay Dhar's user avatar
  • 1,655
4 votes

Authentication and Authorization in Sitecore

This sounds like you want visitors to be able to login to your site. Unless they have accounts in the Sitecore database already, you probably need to integrate using SSO or by using a user store such ...
Jason St-Cyr's user avatar
  • 6,781
4 votes
Accepted

Sitecore Logged In Pipeline in Identity Server?

I've figured out the answer based on the comment from @Gobinath and answer of this thread. So, first you must add NEW config for these Owin and IdentityServer stuffs and don't touch your previous ...
purnadika's user avatar
  • 367
4 votes
Accepted

Why Content Delivery in Sitecore 9.3 is treating users as editors?

This is the support help I got and fixed it: Could you please try overriding the CheckDomainGuard processor using the following: namespace CustomNamespace { public class CustomCheckDomainGuard : ...
Johnny Lopez's user avatar
4 votes
Accepted

Authenticating with "remember me" not persisting beyond a few hours

If your solution is using OWIN authentication with Identity Server (enabled by default in SC 9.1+ instances), you should be able to change the default 30 minutes lifetime of the OWIN authentication ...
Alessandro Faniuolo's user avatar
3 votes
Accepted

Is there any limit for concurrent extranet domain users in a Sitecore website?

No. Not for Extranet users. If a Sitecore license restricts the number of concurrent users, that restriction applies only to CMS users, not to visitors to or extranet users on the published ...
Mark Cassidy's user avatar
  • 25.2k
3 votes

Virtual user custom properties missing on CD server

Virtual user information is saved in Session. By default Sitecore configuration doesn't share sessions information between few CD servers. That is why one CD server doesn't know anything about logged ...
Anton's user avatar
  • 3,821
3 votes
Accepted

Error with Preview when logged in through Active Directory

I found that there is a configuration setting that can be enabled which runs the preview mode with the currently logged in user (an authenticated user) instead of the default/anonymous user. It's ...
Verdoorn's user avatar
  • 143
3 votes
Accepted

Restriction of Pages using sitecore domain

Separate Site Strategy Given your clarifications, have you considered creating a separate site on which to host this protected content? In the site definition you can specify the security domain, and ...
sitecorerick's user avatar
  • 2,329
3 votes
Accepted

Restricted Home Page showing Layout Requested Not Found

I have an old support ticket with a confirmed bug by Sitecore Support (on Sitecore 6.5 and 8.0) that a homepage with broken inheritance can lead to a no-layout error. We did get a patch for it (number ...
Gatogordo's user avatar
  • 20.1k
3 votes

Anonymous login system

You can use a virtual user to accomplish this. This blog from briancaos explains you exactly how. A virtual User is (as the word says) a memory-only Sitecore user that is created "on the fly". Once ...
Gatogordo's user avatar
  • 20.1k
3 votes

Protecting a QA site from anonymous access

Not sure this is what your looking for, but if you add: requireLogin="true" To your site definition, Sitecore will not allow unauthorized users to view the site. I'm not sure how it will behave ...
Thomas Bæk's user avatar
3 votes
Accepted

Why is SignInProcessor triggered twice?

If you issued a redirect with second parameter being default, true, this explains it. What happens in default is, the redirect gets called and then throws an exception to stop further processing. ...
Mark Cassidy's user avatar
  • 25.2k
3 votes
Accepted

Access denied page in Sitecore when using requireLogin

For this, you need to configure loginPage but set requireLogin to false. Your next step will be to remove the access for Everyone on your /sitecore/content/site node and Remove Inheritance. You then ...
Mark Cassidy's user avatar
  • 25.2k
3 votes

Why Content Delivery in Sitecore 9.3 is treating users as editors?

Sitecore support has registered this a bug with reference number 366550, and there is a hotfix available for 9.2 and 9.3 here.
Joost's user avatar
  • 1,907
3 votes

Migrate existing Owin implementation from pre-Sitecore 9

As already mentioned by Mark the best way is to use configuration from Sitecore. Keep in mind the following parts: IdentityProvidersProcessor -- here you can set your authentication settings and ...
Danny Paul's user avatar
3 votes
Accepted

How to prevent multiple sessions from same user

Create a new processor to validate a single session on <owin.cookieAuthentication.signedIn> pipeline, if the same username is already logged in on other devices, we kick out the session and then ...
Gaurav Agarwal's user avatar
2 votes

Sitecore Logs shows The current user cannot be resolved from the authentication cookie

I've seen this error when logged in to the Sitecore backoffice and then attempting to log into the site as a front-end member in the same browser. I don't believe Sitecore can handle this situation ...
trowpa's user avatar
  • 133
2 votes

How to validate a "Disabled" user account

If login fails, you could try to fetch the user and check the Membership user object properties for the status. You can detect the IsApproved flag this way, but not verify the password. But you ...
Gatogordo's user avatar
  • 20.1k
2 votes

Authentication and Authorization in Sitecore

First, have a look at this post that will help you to get started with learning Sitecore. Once you have a handle on Sitecore, you are going to have to decide what kind of membership provider you are ...
Zachary Kniebel's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible