Custom Authentication

Question

I'm in the process of developing a custom login for a website. Users will not be website users with logins, but rather will be authenticated via an email and a custom token. The process should be as follows:

• User arrives at protected page and must enter an email address ending with @acme.com
• If user's email address ends with @acme.com, then generate a token and send them and email with link including the token.

I am trying to figure out the best way to do this in craft. My initial plan was to create a separate php script which handled the email send and token generation via AJAX, but I figured it's not best practice because it is outwith the CMS, so I should maybe develop this as a plugin.

I wondered if any of you could make some suggestions or perhaps if you'd experience such a process before might shed some light on it.

Thanks

Answer 1

Seems totally doable with a plugin.

The protected page where they enter their email address would post to a controller action in your plugin.

Your controller checks the domain of the submitted email, verifies it's from acme.com then generates a token (maybe using StringHelper::UUID() or craft()->security->generateRandomString() if it should be cryptographically secure). I'm assuming you'll save that token into the database for later verification.

You can use craft()->email->sendEmail() to send an email with the link they need to click.

When they click the link, you'd also have it point to another controller action that gets the token from the URL, verifies it's valid, then logs the user in similar to how Craft does it in UsersController->actionLogin(), but minus all of the username/password logic.

Keep in mind, if you invalidate the token after one use (which you probably should), then the user will have to go through this whole process every time they want to log in.