If your site has more than one login provider, the My Account template can output a button to "Manage Logins". This lets users add or remove login options from their account.
This feature can be disabled globally by the
For this functionality to work seamlessly, your subsite should be set to enforce HTTPS connections.
Confirm Username and Password
Pressing the "Manage Logins" button requires the user to re-enter their username and password.
The title and text on this page can be set in the article extras of the My Account template, in the "Account Management" section.
The login options are those already enabled in the user's account (in the screenshot above the user already has a normal site login and a Google login for their account).
If the user enters their password incorrectly, they'll be taken back to the My Account article they were on previously.
Account Management
This page lists a user's current login providers and any other login providers they could link to their account.
The providers listed on the right of this page must:
- Be configured in the Authentication worker
- Comply with the various "allow linking" rules (see the Linking Providers, Account and Profile Management documentation)
- Be enabled in the article extras of the authentication article the user used to log in
When a user adds a third party login they will need to go through the same confirmation and consent steps as they would when logging in with a new account for the first time. If successful they are returned to the manage logins page, logged in using the provider they just added. For example, choosing to add Google from the screenshot above would result in:
Press "Finish" to return to the My Account page.
Confirmation Emails and Profile Updates
See the Linking Providers, Account and Profile Management article for a full technical description, but in summary:
- Users are not emailed about new logins being added (that's only an option when linking on login)
- User profiles are not updated by adding logins to an account
- If the email address in the new login is different to the one in their profile, the user themselves can decide whether or not to update it
