Authentication

All About Logging In and Out

When Will Users Log In?

There are two scenarios that will prompt a user to log in.

Direct Login

A user who isn't logged can log into the site by navigating directly to the site's login article. After successfully authenticating the user will be directed to the "Welcome" article in the article extras. If an article has not been set, the user will be directed to the site's homepage.

Authentication Challenge

If a user who isn't logged in tries to access secure content, they have to log in. The user will be directed to the site's login article, which is picked in the Subsite Configuration - Subsite Configuration - General Settings, and once they've authenticated, they'll be redirected to the secure content they were trying to access.

Upon reaching the secured content the user will either be able to view the content, or be presented with a "Security Denied" message (set in the subsite configuration) should the content be secured to a security group the user is not a member of.

Login Timeout Configuration

When a user logs into your site a login session is created for them. If they remain idle for a period of time, their session will expire and they will be logged out. A session becomes idle if there are no key presses, mouse clicks or any mouse movement for the whole time period, which defaults to twenty minutes.

The default behaviour of sessions and notifications is described in the framework Session Timeouts article. You can customise the idle timeout and the timeout notification text in the Authentication article extras.

If you have more than one authentication article, the settings of the article that was used to log in with are used. That means you could have two articles set up, perhaps one for the public and one for staff, using different authentication providers and different timeouts.