Someone with Enterprise Edition and a public-facing Force.com Site recently asked How would a developer use custom objects and logic to authenticate Guest Site Users without paying license costs for them? Any ideas? I'm thinking that the answer may be to build a custom visualforce registration page that inputs email and name. Upon submission, an "activate your account link" would be sent to the email address provided. Once the user activates their "account" they would access the public site again (as a Guest User because we don't pay for licenses) but content (e.g. custom object records / listings of records in some other visualforce page) would be filtered such that the "logged-in" user only see's custom object records that are deemed presentable to users who have "logged-in" whereas some custom object records would not be viewable.

I think one flaw in how i'm thinking about this is that Org-Wide-Defaults would probably need to be Public for the custom object that is being presented in the later-half of the scenario above. Additionally, the Guest User Profile would need full access to all of its fields. If that's the case, then security is a concern because even if a developer managed to create this makeshift login ability, it wouldn't be secure in that i imagine that a non "logged-in" guest could use API to query all records of the custom object.


(e.g. all of what Guest Site Users can see, or a subset based on what we want to display to the now-logged-in-user) Are there projects out there that solve for this? And is it against Salesforce policy? If so, can you refer to the policy? Thank you!


You will face lot of challenges as you go along .Lets highlight few key challenges

Session Management - This will be very difficult to handle .How will you make sure or identify the Exact User logged in ?Lets say you rely on unique link which has unique Id for every custom object record ,still it will be hard to maintain any sort of audits like how long user was logged In and what time he spent on the sites

Page view limits and API call limits - Sites will have page view and API call limits .This will definitely become hurdle as Users accessing the site will all be treated as Guest User

Record Security - You have already figured this out .There will be security risks and a clever SFDC user can find the session Id of the guest user and he can query all other records out of the system exposed as Site User

Attached is the link to agreement from salesforce

Read below lines carefully

3.2. User Subscriptions. Unless otherwise specified in the applicable Order Form,

(i) Services are purchased as User subscriptions and may be accessed by no more than the specified number of Users,

(ii) additional User subscriptions may be added during the applicable subscription term at the same pricing as that for the pre-existing subscriptions thereunder, prorated for the remainder of the subscription term in effect at the time the additional User subscriptions are added, and

(iii) the added User subscriptions shall terminate on the same date as the pre-existing subscriptions. User subscriptions are for designated Users only and cannot be shared or used by more than one User but may be reassigned to new Users replacing former Users who no longer require ongoing use of the Services.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.