Anonymous user "signing in" using data in row

(0) Share

Report

Posted on by JeckGill

242

I'm trying to create a platform that helps us streamline our onboarding process.

My plan for the moment is to add a row to a table. Using a multipage form in a PowerPage, the user will look themselves up in a combo box and use their GUID to sign in (no passwords feels a bit better).

The purpose of this is to allow these external users to add attachments to data rows.

Is this something that can be done?

Categories:

Design & build

I have the same question (0)

All responses (3)

Answers (0)

Sort by

Suggested answer

oliver.rodrigues 9,475 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!
The solution you are proposing doesn't really align with most scenarios in a modern digital solution. I also wouldn't say it's secure at all.

Using Power Pages, if users can lookup a list of Contacts, there are two issues here

You are exposing a list of people's names, which in my view, it's not compliant with data protection rules and standards

When using Power Pages, the GUID of the Contacts would actually be associated in the dropdown, so basically anyone would have access to that "password

"No Password" approach gives an impression of the system being insecure

Implementing authentication in Power Pages is a lot simpler that it may sound, I would highly recommend you to use Azure B2C / Entra External as your Identity Provider, and if users are already Contacts in your Dataverse/D365, you can invite them to the Portal.

This will ensure they can securely add the attachments to your data.

Was this reply helpful? Yes No
JeckGill 242 on at

Like (0)

Report
Copy link

Link copied!

@oliver.rodrigues

it's just authentication for anonymous users I want though - ideally, I don't want to be creating thousands of users.

GUID as a password made sense to me as it wouldn't be displayed to users. As far as I am aware, there's no way to do a "password" column type in a table.

The whole purpose of this site is to be used every 6-12 months to update files. Literally just a dumping ground for PDFs for people not in the company

Was this reply helpful? Yes No
Suggested answer

oliver.rodrigues 9,475 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

You can restrict registration, keeping only specific users to have access to the Portal.

From a security standpoint, enabling GUID as password, you may end-up allowing users to dump malware / viruses and sharing that with others.

Anonymous access to Portal should only be kept as public data, and no private data should be exposed. That's my view on the topic, I know I am not answering your initial question, but I am just trying to make sure your Portal implementation follows security practices.

Was this reply helpful? Yes No