User Authentication

The User Authentication settings define how users can authenticate, how they recover a forgotten password, and which screen names and email addresses are reserved.

To access these settings, go to Global Menu () → Control Panel → Instance Settings → User Authentication.

User Authentication contains three entries:

• General: Configure how users authenticate and how accounts are created.
• Reminder Queries: Configure the reminder queries users answer to recover a forgotten password.
• Reserved Credentials: Specify the screen names and email addresses users can’t register.

General

The General configuration entry contains several general authentication settings:

How do users authenticate? Choose whether users authenticate by Email Address (default), Screen Name, or User ID (a numerical ID auto-generated in the database, not recommended). This setting corresponds to the company.security.auth.type portal property.

Allow users to automatically log in? Enable/Disable automatic login. If enabled, users can select Remember Me at sign in, which places a cookie in the browser so the site remembers the login information. If disabled, users must always log in manually. This setting corresponds to the company.security.auto.login portal property. The company.security.auto.login.max.age property sets the cookie’s lifetime, which defaults to 31536000 seconds, or one year. A value of -1 limits the cookie to the browser session.

Allow users to request password reset links? Enable/Disable requesting a reset link for forgotten passwords. This setting corresponds to the company.security.send.password.reset.link portal property.

Allow strangers to create accounts? Enable/Disable account creation by unauthenticated guest users. If running an Internet site, leave this enabled so visitors can create accounts. This setting corresponds to the company.security.strangers portal property.

Allow strangers to create accounts with a company email address? Enable/Disable account creation by those using an email address in the domain of the organization running the site (which is set on the General page of Instance Settings). This is handy if you’re using one Liferay installation to host both internal and external web sites. Make sure all internal IDs are created by administrators but external users can register for IDs themselves. This setting corresponds to the company.security.strangers.with.mx portal property.

Require strangers to verify their email address? If this is checked, newly created accounts, whether self-registered or registered by an administrator, require verification. Manual updating of current users’ emails by administrators also requires verification from the new email account. This setting corresponds to the company.security.strangers.verify portal property.

Require password for email or screen name updates? If this is checked, users must enter their password when updating their email address or screen name. This setting corresponds to the company.security.update.password.required portal property.

By default, all settings are enabled. User authentication by email address is an important default for three reasons:

1. An email address is unique to its owner.

2. People remember their email addresses. Users who haven’t logged in for a while could forget their screen names.

3. If email address isn’t used to authenticate, users might change their email addresses and forget to update their profiles. Notifications from the virtual instance then go to an address they no longer read. Signing in with an email address keeps it in view, which helps users keep it current.

Reminder Queries

The Reminder Queries configuration entry defines the questions a user answers when recovering a forgotten password.

Enabled: Users can recover their password by answering a reminder query. This setting corresponds to the users.reminder.queries.enabled portal property and is enabled by default.

Enable custom questions. Users can write their own reminder query instead of choosing one from the list. This setting corresponds to the users.reminder.queries.custom.question.enabled portal property and is enabled by default.

Display answers in plain text. The answer appears as typed instead of masked. This setting corresponds to the users.reminder.queries.display.answer.in.plain.text portal property and is disabled by default.

Required: Users must answer a reminder query when resetting their password. This setting corresponds to the users.reminder.queries.required portal property and is disabled by default.

Questions: Enter the reminder queries, separating them with commas. The default queries are translated; custom queries you add here are not. This setting corresponds to the users.reminder.queries.questions portal property.

Click Save to apply your changes.

Reserved Credentials

The Reserved Credentials configuration entry specifies the screen names and email addresses users aren’t allowed to use. This prevents users from creating IDs that look like administrative IDs or that have reserved words in their names.

You can learn to configure a third party authentication service or set up Single Sign On (SSO) in the security documentation.