1

We have a few experience cloud sites in production. Right now, the login and register flows are passwordless, using the salesforce's native passwordless login and verification functionalities. Our client asked to change this to now add a password to this.

In the backend, when someone registers in the site, a User is created, and a randomized password is set with System.setPassword. When logging in, a verification code is sent via mail to the user and has to enter it to successfuly log in (if the user is found).

Now, they want to remove that verification code flow and only ask for username and password. I understand there is no way to validate a user password from Apex alone as the password is not accessible. I googled a bit and I didn't find any specific information as to how validate a password in a community site context, so here I am, asking for tips or any help.

Do I have to use a OAuth authentication method? If that is the case, I understand that the Username-password Oauth flow is NOT recommended or even supported in community sites. Which one is the best suited for my use case? Really, any help or direction is appreciated.

Improve this question

1 Answer 1

Reset to default
2

You can use Site.login to use their username and password. On successful login, you'll get a PageReference that contains the URL necessary to access site in a logged-in state.

Improve this answer
5
  • I don't see in the documentation what happens on a failed login.... Is an exception thrown?
    – joacoiudica
    Commented Sep 20, 2023 at 16:41
  • 1
    @joacoiudica It just returns null. If you find their username via SOQL, you know it's the password that's incorrect. Also, thinking about it, maybe a custom login flow might be your speed.
    – sfdcfox ♦
    Commented Sep 20, 2023 at 17:08
  • @sfdxfox does Site.login() requiere an external user to work, or does it work with internal users? it is not specified in the documentation either
    – joacoiudica
    Commented Sep 20, 2023 at 18:56
  • @joacoiudica I think that depends on if the user is enabled for that Site/DE. I honestly haven't tried anytime recently, though. I have some stuff to deal with this afternoon, but I'll try to confirm either by docs or by R&D if it does.
    – sfdcfox ♦
    Commented Sep 20, 2023 at 19:20
  • 1
    @joacoiudica I have confirmed that the login appears to work correctly with internal users.
    – sfdcfox ♦
    Commented Sep 20, 2023 at 19:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .