Hi Barry,

Maybe you can check if the page is being used in Preview mode :

UmbracoContext.Current.InPreviewMode

Dave

Thanks Dave - the problem is though the Authorize routine still returns a Http unauthorised - I can't figure out how to override this and continue on to the initial request as an authorised user.

e.g. in the above code I am using UmbracoContext.Current.Security.IsAuthenticated() to ensure its a request from a backoffice user - just dunno how to handle it from there.

Ideally I need a solution so any /Umbraco requests do not get routed though my default controller at all. Further testing shows there are other backoffice API requests failing so I may need to raise this as a bug on the issue tracker.

I think this might have been logged on the tracker already if you wanna give searching there a try

Thanks Shannon - I found the issue and added my experience trying the workaround. Unfortunately I didnt have any success with it:

http://issues.umbraco.org/issue/U4-4219

Now I understand the process a bit better I am going to attempt to skip the base.OnAuthorization(filterContext); in my custom Authorise attribute when I detect a backoffice user and see if that means I can skip login altogether on preview - that would be ideal for my scenario.

Cheers for pointing out the issue!

Strangely I am getting the doc ID appended twice to my preview URL e.g. /umbraco/preview/?id=10747#?id=10747

Not sure why but thought it worth noting. Preview still works fine but seems to be performing a double redirect.

Follow up to this, I am seeing lots of entries like this in the log:

2015-11-17 08:37:39,888 [P3680/D2/T41] INFO Umbraco.Core.Security.UmbracoMembershipProviderBase - Login attempt succeeded for username [email protected] from IP address 127.0.0.1

2015-11-17 08:37:50,913 [P3680/D2/T49] ERROR Umbraco.Core.Security.AuthenticationExtensions - The current identity cannot be converted to Umbraco.Core.Security.UmbracoBackOfficeIdentity System.InvalidOperationException: Cannot create a Umbraco.Core.Security.UmbracoBackOfficeIdentity from System.Security.Claims.ClaimsIdentity since the required claim http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier is missing at Umbraco.Core.Security.UmbracoBackOfficeIdentity.FromClaimsIdentity(ClaimsIdentity identity) at Umbraco.Core.Security.AuthenticationExtensions.GetCurrentIdentity(HttpContextBase http, Boolean authenticateRequestIfNotFound)

This is happening immediately after a MEMBER login is performed. FYI I am overriding the MembershipHelper to provide my own (very simple) Login method:

public bool SiteLogin(string username, string password)
    {
        if (base.Login(username, password))
        {
            try
            {
                // Find the umb member by username and retrieve the isActivated property
                var member = GetByUsername(username);
                var isActivated = member.GetPropertyValue<bool>("isActivated");

                return isActivated;
            }
            catch
            {
                return false;
            }
        }

        // base Login failed
        return false;
    }

It's because it's trying to auth a back office user based on an IPrincipal from a front-end member.

As i said, this all needs to be properly fixed at the core level, if you try to force this i'm sure you'll end up with strange things happening.

Thanks Shannon - looks like a fix is due in 7.4 which will be great.

Just so you know though - This error is still being reported when logging in using the OOTB MembershipHelper.Login() - on a non-protected page, with cookies all wiped beforehand. Basically I have ensured its not running through any custom code to perform the member login/authorisation, and its nothing to do with preview either.

Let me know if you want me to create a new issue for this. Hit me up if you need me to share any setup details if you need to repro (Umbraco version 7.3.0 assembly: 1.0.5750.18157).

Ok, if you have steps to repro, please create a new issue for it and let me know the link.

I'm getting the same, repeated errors as Barry Fogarty in my newly upgraded 7.4.1 site.

This happens whenever a front-end member signs in and also when a backoffice user signs in or, seemingly, edits a page. I have not done any customization or overrides of the membership providers.

Please see http://issues.umbraco.org/issue/U4-4219 fix is due in 7.4.2

is working on a reply...