"This operation is not allowed for internal user profiles" - Custom Digital Experience Login Handler

Question

I am using a Custom Digital Experiences (Communities) Login Page with a custom controller to handle verification and login.

The expectation is, a Sales Agent will create an inactive Community User with an unverified Email Address attached to the user account.

Expected Behaviour

1. The End-User will be presented with the Experience Login Page (custom)
2. The End-User will enter arbitrary information (Agreement Number, Postcode)
3. Our Custom Handler will use this to find the User Profile and trigger a Verification Email
4. The End-User will enter the Verification code into another field and verify their email.
5. Our custom Handler will use this to approve and verify their Authentication Method.
6. The End-User will be logged into the Community.

I'm inexperienced with Communities so it's possible I'm missing something basic.

The Problem

When using the System.UserManagement Classes

• initRegisterVerificationMethod
• verifyRegisterVerificationMethod

as outlined in the documentation below. I'm given the Developer Console error 'This operation is not allowed for internal user profiles'

I've checked and ensured the following

• Running in Community Context (Community User, separate Cache-free browser)
• Community Activated
• Correct Permission Sets for Community User to login
• The Community user has the permission to verify

The concern is, I'm unaware of what Internal User is actually running the operation? Other than maybe the self-generated 'DIGITAL_EXPERIENCE_NAME Guest User' but I'm unable to find this user to check

I intentionally haven't included any code as I'm using a carbon-copy of the code snippet in the documentation provided (other than my using of Auth.VerificationMethod.EMAIL over SMS).

Any help / insight would be amazing thank you all.

Apex Class System User Management Docs

Answer 1

For future reference.

After a couple months and escalated Salesforce support we came up with a solution that works exactly as we need. The approach we took was changed and the documentation was somewhat misleading. Here is how we resolved.

• Use Community Builder standard Login and Register page

• OVERRIDE the Login and Register forms with two custom Lightning Web Component forms. The trick was to allow the UserManagement classes to create the users. Only create the user as a non-persisted object on the Registration Controller.

  • Register LWC uses a custom Apex class named PasswordlessRegistrationController implementing System.UserManagement methods initSelfRegistration and verifySelfRegistration
  • Login LWC uses a custom Apex class named PasswordlessLoginController implementing System.UserManagement Methods initPasswordlessLogin and verifyPasswordlessLogin
  • Both LWCs were split into two screens using <template isTrue=""> to handle the form insertion & Verification Code screen.

• On the user's first visit. They would 'Login for the first time' but in actuality they would inadvertently Register themselves.

• On the user's second visit. They would 'Login again' which would be the real Login.

I added custom login logic to prevent the user registering twice, logging in on the wrong page and error handling etc.

If anyone comes across this issue or user requirement, I'm more than happy to help elaborate.