n3oltd / N3O.Umbraco

N3O extensions to the Umbraco CMS
MIT License
2 stars 3 forks source link

Members authentication for user login #376

Open nadrummond opened 8 months ago

nadrummond commented 8 months ago

We currently have support for members authentication via Auth0 (though this hasn't been extensively tested).

We want to support a login flow for members similar to the below:

image

We want users to be able to login with just their email and receive a link (so they don't have to remember a password) and ideally we want them to always be able to login with whatever provider they want and as long as they have used the same email it should just work.

We need to figure out if the existing Auth0 connection we have is sufficient and we just need to configure the Auth0 side (and what the cost/complexity consequences of that are, e.g. is it per client) or whether we need to do further development work on the Umbraco side.

Useful links:

https://auth0.com/docs/manage-users/user-accounts/user-account-linking

https://auth0.com/docs/authenticate/passwordless/passwordless-with-new-universal-login

talhamalik4025 commented 7 months ago

Profile fields required First Name and Last Name. These should be stored in Auth0 and handled as custom fields during signup. The additional property we need on the Umbraco member is the Account Reference. This is used to put a pledge under a correct account for instance. When a user is creating a fundraising page we check if the member has an account reference already, if not we call an engage API and check if there is a single account with the user's email (Which we should prefill). If no account found for the email, show a form which captures address, telephone, etc. i.e. minimum fields to create an account on engage. (This should reuse the account form from the checkout flow to avoid duplication). The last scenario is where there are multiple accounts in the system. In this case we should display the accounts to the user and allow them to choose which is the correct one (Which will also be prefilled).

talhamalik4025 commented 7 months ago

Plan at this stage is to have a separate Auth0 account per client. Auth0 offers plans for non-profits https://auth0.com/nonprofits. This will allow us to control all aspects of branding and to ensure logins are not reused across clients. For some very large clients, they can provide their own social app API keys, otherwise we will reuse the N3O app keys.