Our customer uses Azure login for everyone. But now they're gonna need a special login page (only in 1 app) for some external users to be able to login to that app without authenticating in Azure.I presume this is possible right?I built a simple screen with username and password inputs but when I call the public action "User_Login" from the Users module it returns "Invalid username or password" for the test user I created. I know for a fact that the password is correct.I'm using this action because it already has built in brute force validation.Can I not use the "User_Login" action for this? Do I need to use another method to validate the password?
Yes, this lines up with a documented platform limitation. OutSystems' own docs on end-user authentication state you can't have two different authentication methods configured for end-users — the auth for your apps must use the same IdP. The only supported way around it is implementing your own custom User Provider for a second authentication mechanism.
So User_Login isn't malfunctioning — once the environment is set up for SAML, the built-in Users module isn't the active credential source anymore, so local passwords stop validating through it. For your one-app exception, you'd likely need a custom User Provider or your own local login flow that checks the password directly.
https://success.outsystems.com/documentation/11/user_management/end_users_authentication/
Do you know of a "substitute" for the brute force validation that's built in the Users module?
There's a Forge component called "Brute Force Block" that adds IP/device-level lockout protection independently of the Users module — could be a good starting point for your custom flow. I haven't verified exactly how it wires into a custom validation flow though, so worth reviewing its docs/OML before committing to it.
https://www.outsystems.com/forge/component-overview/14768/brute-force-block-o11
Thank you. It works nicely.