I have a question about how to handle a somewhat unique authentication situation.

We have an existing system with lots of users that have never had direct access to their accounts before. They have managers that create their accounts for them. If they want some info or to update their data, they ask the manager to do it for them.

So in terms of authentication, the managers have usernames and passwords but the actual end users do not. Now we would like the end users to have access to their own data through a mobile app. Of course, this means they need to authenticate as well.

So we have to somehow let these users create usernames and passwords and link that to their existing account data.

The only solution we've been able to come up with is to generate a special unique access code for each user and send it to them in email or SMS. They would be somewhat short lived (maybe 24 hours) and the user would have to enter them into the registration page as they are logging into the app for the first time.

Seems okay but I'd be interested in hearing other options if anyone has any.

  • 1
    why can't you just grant them access to their data to the same level that that the managers have access? What added security are you trying to get with a 24 hour code? – MikeSchem Nov 13 '18 at 9:07
  • If they now ask the manager for information, why can't the managers give them their initial account information? – Josef Nov 13 '18 at 11:53
  • @MickSchem the point of the code is so that the user logging in only sees their own data. Otherwise the back end wouldn't have any way of knowing which user to show them. Imagine you were creating an account on a banking website. You'd have to supply your account id or SSN for the system to know which account to show you. – user1334007 Nov 13 '18 at 15:10
  • @Josef, I'm not sure how the managers would do that. We don't want to email them out their usernames and passwords and there each manager has too many users to call them each and tell them over the phone what their password is. – user1334007 Nov 13 '18 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.