Password less Registration and Login process with SAP CDC – Part 1

[sureshmusham]

Customer Experience has become the driving factor for many businesses to stand out from competitors. To gain the customer experience we need to understand the customer. SAP Customer Data Cloud solution helps to gain an anonymous user into a loyal customer. The mission of SAP Customer Data Cloud is to acquire and enrich the 1^st party customer data in a frictionless, secure & compliant manner. All this delivered in Agility that is in reduced time to market value with standard screensets.

SAP CDC provides many out-of-the-box options to the Customer to authenticate their site visitors and help them identify on their site. These include basic password driven login, social login, Federation (using SAML and OIDC), Passwordless option (Phone Number Login, FIDO, Push Authentication), SSO and Global Access.

This blog series mainly focuses on how we implement the passwordless authentication using SAP CDC. Passwords are usually a weak link from end user and security perspective. They often can be leaked, guessed or reverse-engineered by attackers. All of these attacks happen remotely without the user knowledge. Hence, having passwordless authentication to your website is always adds additional security, it is much more secure than password. Passwordless authentication protects against credential theft and phishing attacks, which are significant sources of cybercrime.

The SAP CDC passwordless authentication options are aimed at providing the end user a frictionless experience to help logging into the Customers sites.

 

SAP Customer Data Cloud offers below passwordless authentication options:

• Phone Number Login: Passwordlessauthentication via a one-time code sent to user's mobile phones.

• FIDO Authenticaiton: FIDO is a passwordless and phishing-resistant authentication method that's compatible with all device types. It securely stores keys and biometrics within the device, enhancing resilience against common attacks and phishing attempts.

• Email OTP and Magic Link: Users will receive OTP or a link in their email account through the login is processed. Refer:

• Push Authentication: Users authenticate by approving a pop-up notification on their mobile devices instead of manually entering their passwords.

 

Please do check out all parts of this Passwordless Registration and Login process with SAP CDC series.

Part 1:  Phone Number Login  (Current)

Part 2:  FIDO Authentication (Passkey)

Part 3:  Email OTP and Magic Link

Part 4:  Push Authentication

 

Phone Number Login:

SAP CDC provides site users the option for passwordless authentication using a temporary code (one-time password or OTP) sent the phones. The user is created as a new profile if the user data for the phone number doesn’t exists, that means the Registration and Login flows are identical in Phone Number Login process. On registering through Phone Number, the number is saved to the phoneNumber field in Accounts Object.

 

Pre-requisites:

• To use Phone Number Login, SMS provider must be configured initially. The supported SMS providers are as below.
  
  
  
  • Twilio
  
  
  • LiveLink
  
  
  • Sinch
  
  
  
  

 

Additionally, Customer can also use any other SMS provider using CDC Extensions. We can also customize the message received by users. The SMS provider can be configured at the customer partner or site level.

• Place all the required schema fields in the Registration Completion Screen as the phone number login screens do not pass any additional field data apart from Phone Number.


• Phone number must be an active (in service) number.

 

The Mobile Login Flow is as below:

• User will login using a valid phone number to get the code.


• The user will receive an OTP which will used to verify the login the verification screen.


• After successful verification the user will navigated to the Registration completion screen if there any mandatory data fields missing.

 

 

Configuration:

Phone Number Login is achieved using Mobile Login Screens from RegistrationLogin Screenset.

Configure the below screens from RegistrationLogin screenset with the Customer specific styling.

 

Mobile Login Screen:

Mobile Login Verification Screen:

 

Also, configure the phone number edit sceens from ProfileUpdate Screensets:

Edit Phone Number Screen:

Verify Phone number edit screen:

 

Configure the SMS provider under Administration with the necessary provider details.

The existing accounts can be linked using phoneNumber edit screen. Only one phone number is allowed per account. If both accounts contain same phone number, one number is discarded. Also,

 

To add Mobile Login screens to your site, you must start screen with gigya-mobile-login-screen as below:

gigya.accounts.showScreenSet({

    screenSet:'Default-RegistrationLogin',

    startScreen:'gigya-mobile-login-screen' //Specify the Mobile Login start screen, rather that the login one.

});

 

 

Please proceed to the final Part 2 of this blog series to know more about FIDO Authentication (with Passkey) offered by SAP CDC.