Someone with Enterprise Edition and a public-facing Force.com Site recently asked How would a developer use custom objects and logic to authenticate Guest Site Users without paying license costs for them? Any ideas? I'm thinking that the answer may be to build a custom visualforce registration page that inputs email and name. Upon submission, an "activate your account link" would be sent to the email address provided. Once the user activates their "account" they would access the public site again (as a Guest User because we don't pay for licenses) but content (e.g. custom object records / listings of records in some other visualforce page) would be filtered such that the "logged-in" user only see's custom object records that are deemed presentable to users who have "logged-in" whereas some custom object records would not be viewable.
I think one flaw in how i'm thinking about this is that Org-Wide-Defaults would probably need to be Public for the custom object that is being presented in the later-half of the scenario above. Additionally, the Guest User Profile would need full access to all of its fields. If that's the case, then security is a concern because even if a developer managed to create this makeshift login ability, it wouldn't be secure in that i imagine that a non "logged-in" guest could use API to query all records of the custom object.
(e.g. all of what Guest Site Users can see, or a subset based on what we want to display to the now-logged-in-user) Are there projects out there that solve for this? And is it against Salesforce policy? If so, can you refer to the policy? Thank you!