How does user management (authentication / authorization) work when we expose a visualforce page and apex code including controller etc. to community users using public sites, force.com sites.
Users can be added from contact using "Manage External user" button or apex code. When a community is created, a corresponding site is also created. Pages that you want to show as public can be added to the pubic access setting of the site. Access inside the community is controlled by community administration settings and community user's profile/permissionset
To create customer users:
- Create a new contact.
- On the contact detail page, click Manage External User, then Enable Customer User.
- Edit the user record for this external user. Select the appropriate profile. The available profiles are limited to the Customer Community User profile and any profiles cloned from it.
A more detailed description with related info links can be found here https://help.salesforce.com/HTViewHelpDoc?id=networks_create_external_users.htm