<p>Seems totally doable with a <a href="http://buildwithcraft.com/docs/plugins/" rel="nofollow">plugin</a>. </p>

<p>The protected page where they enter their email address would post to a <a href="http://buildwithcraft.com/docs/plugins/controllers" rel="nofollow">controller</a> <a href="http://buildwithcraft.com/docs/plugins/controllers#posting-to-controller-actions" rel="nofollow">action</a> in your plugin.</p>

<p>Your controller checks the domain of the submitted email, verifies it's from <code>acme.com</code> then generates a token (maybe using <a href="http://buildwithcraft.com/classreference/helpers/StringHelper#UUID-detail" rel="nofollow">StringHelper::UUID()</a> or <a href="http://www.yiiframework.com/doc/api/1.1/CSecurityManager#generateRandomString-detail" rel="nofollow">craft()->security->generateRandomString()</a> if it should be cryptographically secure).  I'm assuming you'll save that token into the database for later verification.</p>

<p>You can use <a href="http://buildwithcraft.com/classreference/services/EmailService#sendEmail-detail" rel="nofollow">craft()->email->sendEmail()</a> to send an email with the link they need to click.</p>

<p>When they click the link, you'd also have it point to another controller action that gets the token from the URL, verifies it's valid, then logs the user in similar to how Craft does it in <a href="http://buildwithcraft.com/classreference/controllers/UsersController#actionLogin-detail" rel="nofollow">UsersController->actionLogin()</a>, but minus all of the username/password logic.</p>

<p>Keep in mind, if you invalidate the token after one use (which you probably should), then the user will have to go through this whole process every time they want to log in.</p>

CC BY-SA 3.0
2015-10-08T10:39:36.640Z
Thank you! Your guidance was invaluable, I have now built my first Craft plugin! Works a treat. 

The page isn't typically accessed often, so the user does have to go through the process each time the token expires.
Kyle
CC BY-SA 3.0
2015-10-08T15:38:48.807Z
Awesome! Would you mind marking as the correct answer?
Brad Bell
CC BY-SA 3.0
2017-08-08T02:18:34.967Z
Is the plugin on Github?
Leevi Graham
CC BY-SA 3.0
2015-10-02T00:47:51.670Z
2015-10-02T00:47:51.670Z
Brad Bell
<p>I'm in the process of developing a custom login for a website. Users will not be <em>website</em> <em>users</em> with logins, but rather will be authenticated via an email and a custom token. The process should be as follows:</p>

<ul>
<li>User arrives at protected page and must enter an email address ending
with @acme.com</li>
<li>If user's email address ends with @acme.com, then generate
a token and send them and email with link including the token.</li>
</ul>

<p>I am trying to figure out the best way to do this in craft. My initial plan was to create a separate php script which handled the email send and token generation via AJAX, but I figured it's not best practice because it is outwith the CMS, so I should maybe develop this as a plugin.</p>

<p>I wondered if any of you could make some suggestions or perhaps if you'd experience such a process before might shed some light on it.</p>

<p>Thanks</p>

CC BY-SA 3.0
2015-10-01T22:31:55.827Z
Do you expect users to go through this process every time they wish to log in?
Brandon Kelly
CC BY-SA 3.0
2015-10-08T10:40:54.947Z
Yes, the page isn't accessed very often so I don't imagine it should be a huge problem.
Kyle
<plugin-development><authentication>
Custom Authentication
# Custom Authentication

(Asked by: username_0 on 2015-10-01)

I'm in the process of developing a custom login for a website. Users will not be *website* *users* with logins, but rather will be authenticated via an email and a custom token. The process should be as follows:

* User arrives at protected page and must enter an email address ending
  with @acme.com
* If user's email address ends with @acme.com, then generate
  a token and send them and email with link including the token.

I am trying to figure out the best way to do this in craft. My initial plan was to create a separate php script which handled the email send and token generation via AJAX, but I figured it's not best practice because it is outwith the CMS, so I should maybe develop this as a plugin.

I wondered if any of you could make some suggestions or perhaps if you'd experience such a process before might shed some light on it.

Thanks

**Tags:** plugin-development, authentication
> **Comments:**
> **username_1**: Do you expect users to go through this process every time they wish to log in?  
> **username_0**: Yes, the page isn't accessed very often so I don't imagine it should be a huge problem.  

---

## 1 answers

### Answer by username_2 on 2015-10-02. Score: 2 | Accepted answer

Seems totally doable with a [plugin](http://buildwithcraft.com/docs/plugins/).

The protected page where they enter their email address would post to a [controller](http://buildwithcraft.com/docs/plugins/controllers) [action](http://buildwithcraft.com/docs/plugins/controllers#posting-to-controller-actions) in your plugin.

Your controller checks the domain of the submitted email, verifies it's from `acme.com` then generates a token (maybe using [StringHelper::UUID()](http://buildwithcraft.com/classreference/helpers/StringHelper#UUID-detail) or [craft()->security->generateRandomString()](http://www.yiiframework.com/doc/api/1.1/CSecurityManager#generateRandomString-detail) if it should be cryptographically secure). I'm assuming you'll save that token into the database for later verification.

You can use [craft()->email->sendEmail()](http://buildwithcraft.com/classreference/services/EmailService#sendEmail-detail) to send an email with the link they need to click.

When they click the link, you'd also have it point to another controller action that gets the token from the URL, verifies it's valid, then logs the user in similar to how Craft does it in [UsersController->actionLogin()](http://buildwithcraft.com/classreference/controllers/UsersController#actionLogin-detail), but minus all of the username/password logic.

Keep in mind, if you invalidate the token after one use (which you probably should), then the user will have to go through this whole process every time they want to log in.

> **Comments:**
> **username_0**: Thank you! Your guidance was invaluable, I have now built my first Craft plugin! Works a treat.   The page isn't typically accessed often, so the user does have to go through the process each time the token expires.  
> **username_2**: Awesome! Would you mind marking as the correct answer?  
> **username_3**: Is the plugin on Github?  

---

