Allow my customers to edit their details via force site

Question

I want to allow my customers to be able to sign into my force.com site (via authenticated website access) and allow users to view and edit certain fields related to them (i.e. email &phone details etc).

Now the first issue I have is that there are duplicate details held on the customer, one in the Contacts object and another in the Users table (when they have authenticated website/customer portal) access. How can I have both records sync'ed when they update their details?

The second issue is I've attempted to create a simple page with a standard Contact controller to display the contact details to the user but this has failed, the page returns...

Error: Insufficient Privileges

I know its not because the privileges are not setup correctly because as soon as I take out outputText line from the following text, the page loads

Page:

<apex:page showHeader="false" title="My Details" standardController="Contact">
<apex:composition template="{!$Site.Template}">
<apex:define name="body">  
...
<dt>Name</dt>
<dd><apex:outputText value="{!Contact.Name}"/></dd>
....

UPDATE:
I have added the debug logs found by executing the page

Operation: /apex/MyDetailsView

32.0 APEX_CODE,DEBUG;APEX_PROFILING,INFO;CALLOUT,INFO;DB,INFO;SYSTEM,DEBUG;VALIDATION,INFO;VISUALFORCE,INFO;WORKFLOW,INFO
15:37:29.262 (262815771)|EXECUTION_STARTED
15:37:29.262 (262862653)|CODE_UNIT_STARTED|[EXTERNAL]|066c0000000DQvS|VF: /apex/MyDetailsView
15:37:29.729 (272799402)|CUMULATIVE_LIMIT_USAGE
15:37:29.729|LIMIT_USAGE_FOR_NS|(default)|
  Number of SOQL queries: 0 out of 100
  Number of query rows: 0 out of 50000
  Number of SOSL queries: 0 out of 20
  Number of DML statements: 0 out of 150
  Number of DML rows: 0 out of 10000
  Maximum CPU time: 0 out of 10000
  Maximum heap size: 0 out of 6000000
  Number of callouts: 0 out of 100
  Number of Email Invocations: 0 out of 10
  Number of future calls: 0 out of 50
  Number of queueable jobs added to the queue: 0 out of 50
  Number of Mobile Apex push calls: 0 out of 10

15:37:29.729|CUMULATIVE_LIMIT_USAGE_END

15:37:29.272 (272850622)|CODE_UNIT_FINISHED|VF: /apex/MyDetailsView
15:37:29.274 (274621515)|EXECUTION_FINISHED

Operation: /apex/Exception

31.0 APEX_CODE,DEBUG;APEX_PROFILING,INFO;CALLOUT,INFO;DB,INFO;SYSTEM,DEBUG;VALIDATION,INFO;VISUALFORCE,INFO;WORKFLOW,INFO
15:37:30.167 (167877079)|EXECUTION_STARTED
15:37:30.167 (167923323)|CODE_UNIT_STARTED|[EXTERNAL]|066c0000000DNjs|VF: /apex/Exception
15:37:30.033 (198682069)|CUMULATIVE_LIMIT_USAGE
15:37:30.033|LIMIT_USAGE_FOR_NS|(default)|
  Number of SOQL queries: 0 out of 100
  Number of query rows: 0 out of 50000
  Number of SOSL queries: 0 out of 20
  Number of DML statements: 0 out of 150
  Number of DML rows: 0 out of 10000
  Maximum CPU time: 0 out of 10000
  Maximum heap size: 0 out of 6000000
  Number of callouts: 0 out of 100
  Number of Email Invocations: 0 out of 10
  Number of future calls: 0 out of 50
  Number of queueable jobs added to the queue: 0 out of 50
  Number of Mobile Apex push calls: 0 out of 10

15:37:30.033|CUMULATIVE_LIMIT_USAGE_END

15:37:30.198 (198730579)|CODE_UNIT_FINISHED|VF: /apex/Exception
15:37:30.200 (200337369)|EXECUTION_FINISHED

Answer 1

The reason that you are running into an issue is because Authenticated Website users do not have access to the Contact object. Visualforce will not display anything on the page for bound sObject fields in which the user does not have access to view/edit, whatever your page is trying to do.

More information about license permissions can be found from Wes Nolte and the friendly folks at Tquila: https://docs.google.com/a/salesforce.com/spreadsheet/ccc?key=0AuSsu_7yn04IdDRxajlZM196aGM1bUx2MHlMdERraHc&usp=sharing#gid=0

With the caveat that this is a violation of your Master Subscription Agreement, it is technically possible to do what you're proposing.

You can always instead of binding to the Contact sObject create your own wrapper class that mirrors the contact object. Visualforce cannot tell that this wrapper is not allowed for your user license type. You can then set the fields on the object from your wrapper to the Contact in apex. I want to be clear that this subverts the entire security model of Salesforce that your administrator has setup, in addition to the terms of service violation I mentioned earlier, so you the developer are now responsible for your data integrity and data visibility in this scenario, essentially rolling your own security and permissions.

With regard to your first question, you have two options to keep the data on your Contact and related User in sync. You can do this within the context of your registration handler or you can do this via trigger.

The recommended solution here is to use a license type that allows for this type of object access. In this case I think Customer Communities would do the trick.