About End-User Authentication

This product version has reached end of life and is no longer supported. Click here for the latest documentation.

When you start developing a new eSpace module, by default, it already contains logic to perform end-user authentication. The OutSystems Platform supports three distinct authentication modes out of the box: Internal, Active Directory, LDAP:

Internal - The user information is stored in the OutSystems Platform database. The credentials are not stored, instead a cryptographic hash function is computed using the credentials, and only its result is stored. When the end-user logs in, the hash function is computed again and its result is compared with what is stored in the database;
Active Directory - Uses your Active Directory to authenticate the users. This option is only available for the .NET stack;
LDAP - Authenticates the user against your LDAP server;

By default, Internal authentication is performed.

Authentication Flow

When the user enters the application for the first time, if the screen being accessed only allows authenticated users to see it, then a security exception is raised. The following authentication process is followed:

If the platform is configured to use Windows Integrated Authentication and the end-user is inside the internal network , the user is authenticated using Windows Integrated authentication. Once the user makes a request, the server replies with an HTTP 401 status, signaling to the end-user browser that authentication is required.
If the browser already has the end-user credentials stored, it automatically sends the credentials to the web server. Otherwise, the browser displays a form for the user to input the credentials and sends them to the server. This means that even if you have a custom Login page, the end-user will not see it. Learn more About Integrated Authentication .
If the platform is not configured to use Windows Integrated Authentication, the user is redirected to a Login screen. When the user submits the credentials:
1. The credentials are validated against the OutSystems Platform database;
2. If the platform is configured to authenticate using Active Directory, the credentials are validated against the domain server configured;
3. If the platform is configured to authenticate using LDAP, the credentials are validated against the LDAP server configured.

If after this process the user could not be authenticated, then an 'Invalid Login' message is displayed to the end-user.