6

Is there a way to control who access the force.com site externally besides using IP addresses?

I tried using a profile checker:

public static String ProfileCheck(){
String ReturnVal;
Profile Pro;
    Pro = [Select Name from Profile where Id = :userinfo.getProfileId()];

    if( Pro.Name == 'Chatter Free User' || Pro.Name == 'System Administrator' || Pro.Name == 'GRI'){
    ReturnVal = 'true';
    }
    else{
        ReturnVal = 'false';
    }
 return ReturnVal;

    }

Then it would do a redirect if ReturnVal == False to send the person to the standard unauthorized page.

I realize this could easily be handled if they were all SFDC users because I could just enable it by profile. Which leads me to my one issue is that there will be about 5 or so people that are not SF users that need access to this site. Other than those 5 people it should remain protected from anyone else that tries to access it. Any Ideas outside of hard-coding IP addresses would be great.

Thanks in advance.

Improve this question
3
  • wiki.developerforce.com/page/…
    – techtrekker
    Commented Jun 10, 2013 at 20:30
  • Sorry. Exclude the possibility of a portal.
    – AlphaBravo
    Commented Jun 10, 2013 at 20:36
  • You lose all sorts of security controls when you decide not to use standard authentication (using portal or auth website licenses). Every time I've seen this requirement come up, the customer has eventually opted to spend the small amount of bucks for proper security. That said, if you're looking for something other than proper sign-in, I'd probably do something like give each one of these 5 users a magic URL that sets a cookie on their system that permits them access to otherwise protected pages. LOTS of problems with this approach though (no user audit, no sharing, not that secure, etc).
    – jkraybill
    Commented Jun 12, 2013 at 0:06

3 Answers 3

Reset to default
1

You could implement some version of Oauth. There's a tutorial that utilizes Github showing how to do it. The tutorial was intended for a mobile app, but the principle is entirely the same. I think you'll find readily existing code for a log-in controller if you search around. The tutorial is in the Security Workbook.

BTW, sites itself has a guest login and registration that can be enabled along with a profile. Have you at all looked at that? Its described in the Site.com Workbook.

Improve this answer
1

Looks like the only good solution is IP Address on the profile -OR- Oauth with Customer Portal (if you already pay for the portal).

Improve this answer
1

Since these users are guest users, it could be hard to control who could access the site. I would implement the following ways. a. Provide these users a link with a key querystring which would be generated weekly and sent in an email to these users. b. First time any user hits a page would be prompted to a page where they would provide some credentials which would prompt a querystring in an email. The user clicks it and system would store it in a custom object. c. Every time the user comes,it would prompt them for the key or they can use the url d. End of the week, a workflow timer can send an email with a new key. This seems to have some maintenance work but would be an ideal solution for guest users.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .