Authentication

Site Users and Groups

After successfully authenticating against an external provider, user details are retrieved, mapped to the Authentication worker's UserProfile class, and a site user created or updated. An appropriate login is recorded against the user's account.

Site users are added to the groups set in the article extras of the login article. This should normally include the "default" security group for your site. Users will also be added to a group named after the type of external provider that created them, using the providerName set in the configuration of that provider. Should this group not already exist it will be automatically created.

Example Site User

The following user was created after authenticating via Facebook.

The user has been made a member of three groups.

The first of these is the default Facebook group automatically created by the Authentication worker. The other two were assigned at the time of login, and are set in the article extras of the Authentication template article.

User logins created by authenticating with an external provider cannot be used by a user to log in via the iCM Site User username and password method (the "already a member" option), despite them existing as users in iCM. The username of the login will never be known to the user and the password is not stored in iCM. Authentication is handled entirely by the external provider.

iCM Site User - Logging in Directly

You don't have to use third party logins at all. User can register directly with your site and log in with a username and password. This involves the following:

• Registration Form - This form asks a user for their email address (which becomes their login username), confirm via a PIN, then pick a password. There's a full description in Registration
• Logging In - Enter a username and password to log in, as seen in Logging In

The iCM Site user provider also supports the following features.

Two-Factor Authentication

The iCMSiteUser provider can have two-factor authentication enabled. This functionality is provided entirely by the Authentication worker and not controlled by your login article or the Authentication template.

If enabled, the user will be sent a PIN to the email address in their user profile, which they'll have to enter to access your site.

Login Via Link

Rather than enter a username and password, the iCMSiteUser provider can be set up so the user is emailed a link. Following the link will log them in automatically.

Failed Logins

If a user gets their username or password wrong, they'll receive an error message advising them that either the username or password they entered was incorrect. We don't specify which so you can't guess a registered username.

Multiple attempts to log in with a valid username but incorrect password may cause the user to become locked out. The default is to be locked out for 15 minutes after 5 failed login attempts. Both the lockout threshold and lockout duration are configured in the iCMSiteUser provider of the Authentication worker.

Third Party Logins and Linking

Users can also log in with third party logins. These must be set up as login providers in the Authentication worker, and picked in the article extras of your login article (so they appear on the page).

If a user isn't already registered, they can log in with a third party login and an account will be created for them, as described above.

If their email address is already registered with a user on your site, they may be prompted to link their login to their existing account. See Linking Providers, Account and Profile Management.

Logins can also be added to or removed from an account using the Manage Logins button on the My Account template.