Preserving session after login

Question

Consider this scenario:

Customer goes to my force.com site. Ex: www.mysitename.com

Customer logs in to authenticated force.com site with custom URL. Domain.secure.force.com

Customer closes window/tab, goes anywhere else. Customer comes back to the public URL.

Here's the problem...to them, the site appears like they aren't logged in. If they do try to log in, they will get a visualforce error page because they're already logged in.

Ideal scenario...public page recognizes they're still the same user and shows them logged in.

Decent hack...we catch the "already logged in" error and do a redirect to the secure site without telling the user. OR, kill the previous session and start a new one...as long as the user isn't impacted.

How can I make the site do one of these "smarter" behaviors?

Answer 1

You could just not display the log in form if the user is already logged in, but instead displays a link to whatever the action of logging in takes them to or do whatever it is you want to for the logged in user when they visit the main page.

So, on the VF page that displays the www.mysitename.com have something like:

<apex:outputPanel rendered="{!ISPICKVAL($User.UserType,'Guest')}">
     Not logged in.  Code for log in form goes here.
</apex:outputPanel>
<apex:outputPanel rendered="{! NOT(ISPICKVAL($User.UserType,'Guest'))}">
     Logged in. Code for link to post log in landing page or something else.
</apex:outputPanel>

If you'd rather have them redirected immediately upon accessing the public page while logged in you could use an apex:page action on the public page. Something like the following:

<apex:page controller="MyMainPageController" action="{!redirectIfLoggedIn}">
</apex:page>

Then in the MyMainPageController, something like:

public PageReference redirectIfLoggedIn() {
    if (UserInfo.getUserType() != 'Guest') {
        PageReference loggedInPage = getLoggedInPageSomehow();
        return loggedInPage;
    }
    // Guest user so just display as usual.
    return null;
}

Answer 2

Registering a Site domain and Maintaining a Session For all those people who want to register and free force.com site and maintain a session for users, I request you to first create a fresh developer.force.com account even if you have one and follow the following steps.

WORDS OF WISDOM Instead of finding out why the problem is occurring in your existing portal and debugging it, create a new one and copy all your objects through workbench(If you don't know how to do this, share your email id and I will send you a ppt defining this step by step process), copy and paste visualforce pages and apex classes to your new force.com account.

STEPS 1. Customer Portal -> Settings -> Activate the portal, Enable Self Registration, Set Default New User License as Customer Portal Manager Standard, Set Default User Role as User and Default New User Profile as Customer Portal Manager Standard.

1. Create an Account and copy its Account ID

2. Manage Users->Roles->Company size based sample-> Set up Roles->Either Add Role or Assign to existing role the above account created.

3. Develop->Sites->Search availability and register a domain

4. Edit the Site Details by providing name and other details. To start with keep the homepage as SiteLogin, Change Password as ChangePassword page and Profile Page as MyProfilePage.

5. Activate the Site

6. Click on Site Name and go to Login Settings->Edit->Select the customer portal so created

7. Now the site is activated and login is enabled

8. Go to SiteRegisterController page->Edit -> Replace the default PORTAL_ACCOUNT_ID with the above copied Account ID

9. Go to MyProfileController->Edit->Comment the if condition which throws exception in case of Guest User.

10. Go to SiteLoginController , change the return value of the login method with ‘return Page.MyProfilePage;’

11. Go to Develop ->Sites->Click on Site URL

12. If all the steps are done correctly, the Site will show hyperlinks for NewUser, ForgotPassword and Login on the Header as well as on the Output Panel.

13. Click on New User, enter the details and on clicking submit you will be redirected to the Login page. Enter your username and password registered. If all the above steps are done correctly, you will be directed to the MyProfilePage which will show you the logged in user credentials alongwith change password button and a logout button.

14. Copy paste the same URL on another browser or private browsing or incognito window and you will see the message of authentication required.

15. If you click on Logout, you will be redirected to the login page again.

Answer 3

The final answer on this was to migrate to customer communities. This keeps everything on the same custom domain, including https, so there's never a login button shown for people with a session.

The original challenge was more of a feature limitation of custom domains on authenticated sites.