I have a question about how to handle a somewhat unique authentication situation.
We have an existing system with lots of users that have never had direct access to their accounts before. They have managers that create their accounts for them. If they want some info or to update their data, they ask the manager to do it for them.
So in terms of authentication, the managers have usernames and passwords but the actual end users do not. Now we would like the end users to have access to their own data through a mobile app. Of course, this means they need to authenticate as well.
So we have to somehow let these users create usernames and passwords and link that to their existing account data.
The only solution we've been able to come up with is to generate a special unique access code for each user and send it to them in email or SMS. They would be somewhat short lived (maybe 24 hours) and the user would have to enter them into the registration page as they are logging into the app for the first time.
Seems okay but I'd be interested in hearing other options if anyone has any.