17
votes
Accepted
Does Sitecore support SAML?
This will be natively supported in Sitecore 9.0, according to the public roadmaps. For now a solution might be to use this module: https://github.com/BasLijten/SitecoreFederatedLogin
See my blog on ...
- 1,857
12
votes
Does Sitecore support SAML?
It might. There is a company claiming to have an option for it, but there is no direct download link and no way to easily verify the claim.
https://www.ssoeasy.com/sitecore-sso/
That said; you might ...
- 25k
9
votes
Does Sitecore support SAML?
1) Sitecore 9+ natively supports SAML through Federated Authentication.
You have to configure it and write your own provider.
These links will guide you through this process for Sitecore 9:
Usage in ...
- 9,356
9
votes
Accepted
How to implement forgot password feature in any Sitecore application
Disclosure: answer taken from Securing the password recovery experience in Sitecore 8 by Anders Laub Christofferson
First we do some configuration re-organizing.
We copy paste the old ...
- 2,910
7
votes
Accepted
Experience Editor Timeout change
They are all slightly different things and do not necessarily need to be in sync:
<forms name=".ASPXAUTH" cookieless="UseCookies" timeout="20" />
Is a Forms Timeout and is the length in time ...
- 1,651
6
votes
Architecture choices for integrating Azure AD with Sitecore
I cannot give you a detailed answer but you should know that in the future (not yet scheduled) the AD module will be retired and Sitecore will move away from the Microsoft Membership model and towards ...
- 5,653
6
votes
Accepted
Is Virtual user concept available in XM version?
Yes, you can use virtual users in XM:
Sitecore also supports Virtual Users, which is a transient user account system that you can use, for example, when integrating with custom authentication ...
- 6,696
5
votes
Accepted
Authentication and Authorization in Sitecore
I am afraid this question is quite extensive.
Sitecore uses ASP.NET membership, role and profile providers.
As a starting place, please check this Security API Cookbook.
This will give you a ...
- 904
5
votes
Accepted
Share Session across Sitecore subsites
You can use SSO software to treat all of the sites as part of a single 'authentication' realm. That way you log in once and then each site pings back to your SSO software to get the token or ...
- 6,696
5
votes
Accepted
PostLogoutRedirectUri with Owin and Azure ADb2C
Probably might help someone. I managed to figure this out as the issue was on the Controller Action for SignOut.
Sitecore handles the Owin Middleware integration little differently from Asp.NET. ...
- 1,655
4
votes
Authentication and Authorization in Sitecore
This sounds like you want visitors to be able to login to your site. Unless they have accounts in the Sitecore database already, you probably need to integrate using SSO or by using a user store such ...
- 6,696
4
votes
Accepted
Sitecore Logged In Pipeline in Identity Server?
I've figured out the answer based on the comment from @Gobinath and answer of this thread.
So, first you must add NEW config for these Owin and IdentityServer stuffs and don't touch your previous ...
- 357
4
votes
Accepted
Why Content Delivery in Sitecore 9.3 is treating users as editors?
This is the support help I got and fixed it:
Could you please try overriding the CheckDomainGuard processor using the following:
namespace CustomNamespace
{
public class CustomCheckDomainGuard : ...
- 81
4
votes
Accepted
Authenticating with "remember me" not persisting beyond a few hours
If your solution is using OWIN authentication with Identity Server (enabled by default in SC 9.1+ instances), you should be able to change the default 30 minutes lifetime of the OWIN authentication ...
- 2,554
3
votes
Accepted
Is there any limit for concurrent extranet domain users in a Sitecore website?
No.
Not for Extranet users.
If a Sitecore license restricts the number of concurrent users, that
restriction applies only to CMS users, not to visitors to or extranet
users on the published ...
- 25k
3
votes
Virtual user custom properties missing on CD server
Virtual user information is saved in Session. By default Sitecore configuration doesn't share sessions information between few CD servers. That is why one CD server doesn't know anything about logged ...
- 3,751
3
votes
Accepted
Error with Preview when logged in through Active Directory
I found that there is a configuration setting that can be enabled which runs the preview mode with the currently logged in user (an authenticated user) instead of the default/anonymous user.
It's ...
- 143
3
votes
Accepted
Restriction of Pages using sitecore domain
Separate Site Strategy
Given your clarifications, have you considered creating a separate site on which to host this protected content? In the site definition you can specify the security domain, and ...
- 2,329
3
votes
Accepted
Restricted Home Page showing Layout Requested Not Found
I have an old support ticket with a confirmed bug by Sitecore Support (on Sitecore 6.5 and 8.0) that a homepage with broken inheritance can lead to a no-layout error. We did get a patch for it (number ...
- 19.8k
3
votes
Anonymous login system
You can use a virtual user to accomplish this. This blog from briancaos explains you exactly how.
A virtual User is (as the word says) a memory-only Sitecore user that is created "on the fly". Once ...
- 19.8k
3
votes
Protecting a QA site from anonymous access
Not sure this is what your looking for, but if you add:
requireLogin="true"
To your site definition, Sitecore will not allow unauthorized users to view the site. I'm not sure how it will behave ...
- 623
3
votes
Accepted
Why is SignInProcessor triggered twice?
If you issued a redirect with second parameter being default, true, this explains it.
What happens in default is, the redirect gets called and then throws an exception to stop further processing. ...
- 25k
3
votes
Accepted
Access denied page in Sitecore when using requireLogin
For this, you need to configure loginPage but set requireLogin to false.
Your next step will be to remove the access for Everyone on your /sitecore/content/site node and Remove Inheritance. You then ...
- 25k
3
votes
Why Content Delivery in Sitecore 9.3 is treating users as editors?
Sitecore support has registered this a bug with reference number 366550, and there is a hotfix available for 9.2 and 9.3 here.
- 1,897
3
votes
Accepted
How to prevent multiple sessions from same user
Create a new processor to validate a single session on <owin.cookieAuthentication.signedIn> pipeline, if the same username is already logged in on other devices, we kick out the session and then ...
- 3,582
2
votes
Sitecore Logs shows The current user cannot be resolved from the authentication cookie
I've seen this error when logged in to the Sitecore backoffice and then attempting to log into the site as a front-end member in the same browser.
I don't believe Sitecore can handle this situation ...
- 133
2
votes
How to validate a "Disabled" user account
If login fails, you could try to fetch the user and check the Membership user object properties for the status. You can detect the IsApproved flag this way, but not verify the password.
But you ...
- 19.8k
2
votes
Authentication and Authorization in Sitecore
First, have a look at this post that will help you to get started with learning Sitecore. Once you have a handle on Sitecore, you are going to have to decide what kind of membership provider you are ...
- 8,929
2
votes
Accepted
Log in virtual user with persistent flag
As mentioned already, a Virtual user is transitory - it cannot be persisted from visit to visit.
So you need to look at this differently. When integrating with an external authentication service, ...
- 19.9k
2
votes
Sitecore losing the client session unexpectedly
Try to pass the persistent paramenter:
Sitecore.Security.Authentication.AuthenticationManager.Login("extranet\\" + username, password, persistent: true, allowLoginToShell: false);
- 138
Only top scored, non community-wiki answers of a minimum length are eligible