You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/_dangling-articles/principles-for-use.mdx
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,23 +10,23 @@ Following a few key principles will help you get the most out of User Store.
10
10
11
11
### 1. Avoid storing raw PII outside of the Safety Layer, unless necessary
12
12
13
-
The key benefits of Safety Layer come from the ability to draw a protective boundary around your data. This boundary governs access control and minimizes or <<glossary:tokenize>>soutbounddata.Ifdataisstoredoutsidethestore,itdoesnotreceivetheseprotectivebenefits.Whenapplicationsoremployeesneedrawdatatocompleteatask,theyshouldholdthedatafortheminimumtimeframerequiredtocompletethetask.
13
+
The key benefits of Safety Layer come from the ability to draw a protective boundary around your data. This boundary governs access control and minimizes or <Glossary>tokenize</Glossary>s outbound data. If data is stored outside the store, it does not receive these protective benefits. When applications or employees need raw data to complete a task, they should hold the data for the minimum time frame required to complete the task.
14
14
15
15
### 2. When PII must be stored outside of the Safety Layer, tokenize or mask it wherever possible
16
16
17
-
Ofcourse,sometimes,datadoesneedtobestoredoutsideoftheSafetyLayer,e.g.forofflinedataanalysis.Inthesecases,usea<<glossary:datatransformer>> to obscure the data as much as possible. For example, use a tokenizing function that replaces the data with a random UUID. Attach this <<glossary:token>>toanaccesspolicythatonlyallowsthetokentoberesolvedinspecificcircumstances,suchasbyanauthenticatedemployee,withtheroleofengineer,onthecompanyVPN.
17
+
Of course, sometimes, data does need to be stored outside of the Safety Layer, e.g. for offline data analysis. In these cases, use a <Glossary>data transformer</Glossary> to obscure the data as much as possible. For example, use a tokenizing function that replaces the data with a random UUID. Attach this <Glossary>token</Glossary> to an access policy that only allows the token to be resolved in specific circumstances, such as by an authenticated employee, with the role of engineer, on the company VPN.
18
18
19
19
### 3. Use transformers to minimize the information carried by a piece of data for a given task
20
20
21
-
Whenyouarepassingdataoutofthestoreforaspecifiedusecase,minimizetheinformationasmuchaspossibleforthespecifiedtask.Forexample,ifyouwanttoconductanalysisassessingthedifferencesinbehaviorbetweenchildrenandadults,donotpullrawDatesofBirthfromthestore.Instead,usea<<glossary:datatransformer>> to pass a string indicating `child` or `adult`. By minimizing outbound data, you reduce your surface area from attack, enable better enforcement of least privilege and better align with the GDPR principle of data minimization.
21
+
When you are passing data out of the store for a specified use case, minimize the information as much as possible for the specified task. For example, if you want to conduct analysis assessing the differences in behavior between children and adults, do not pull raw Dates of Birth from the store. Instead, use a <Glossary>data transformer</Glossary> to pass a string indicating `child` or `adult`. By minimizing outbound data, you reduce your surface area from attack, enable better enforcement of least privilege and better align with the GDPR principle of data minimization.
22
22
23
23
### 4. Create different accessors and mutators for different use cases
24
24
25
-
User Store makes creating a new <<glossary:accessor>>(readAPI)assimpleaswritingadatabasequery.Thisisbecauseaccessorsareintendedtobeuse-casespecific.Forexample,youshouldconfigureoneaccessor`GetPhoneAndNameForMarketing`,andanother`GetPhoneForMFA`.Configuringoneaccessorperusecasemakesaccidentalmisuseofthesystemlesslikely.Itletsyouenforcedifferentpurpose-basedaccesspoliciesfordifferentusecases,automaticallycreateanauditlogofdataaccessandturnoffindividualdatastreamsincaseofemergency.ItisessentialforautomaticallygeneratingDPIAsandotherdocumentationaboutdatausepractices.
25
+
User Store makes creating a new <Glossary>accessor</Glossary> (read API) as simple as writing a database query. This is because accessors are intended to be use-case specific. For example, you should configure one accessor `GetPhoneAndNameForMarketing`, and another `GetPhoneForMFA`. Configuring one accessor per use case makes accidental misuse of the system less likely. It lets you enforce different purpose-based access policies for different use cases, automatically create an audit log of data access and turn off individual data streams in case of emergency. It is essential for automatically generating DPIAs and other documentation about data use practices.
26
26
27
27
### 5. Re-use access policies, transformers and validators to keep your code [DRY](https://en.wikipedia.org/wiki/Don't_repeat_yourself)
28
28
29
-
Unlikeaccessors,each<<glossary:accesspolicy>>, <<glossary:datatransformer>> and validator can be re-used to maximize auditability, reduce update costs and prevent errors. Access policies can be easily built from parametrizable <<glossary:accesspolicytemplate>>s. This allows you to update a set of access policies with parallel logic just by updating the template. Similarly, complex access policies can be composed of other policies to maximize re-use.
29
+
Unlike accessors, each <Glossary>access policy</Glossary>, <Glossary>data transformer</Glossary> and validator can be re-used to maximize auditability, reduce update costs and prevent errors. Access policies can be easily built from parametrizable <Glossary>access policy template</Glossary>s. This allows you to update a set of access policies with parallel logic just by updating the template. Similarly, complex access policies can be composed of other policies to maximize re-use.
30
30
31
31
### 6. Adopt a naming practice for accessors and mutators that describes what they do and why
excerpt: "What is UserClouds Authentication, and why use it?"
5
+
hidden: false
6
+
metadata:
7
+
image: []
8
+
robots: "index"
9
+
createdAt: "Thu Aug 03 2023 22:34:20 GMT+0000 (Coordinated Universal Time)"
10
+
updatedAt: "Thu Aug 03 2023 23:58:35 GMT+0000 (Coordinated Universal Time)"
11
+
---
12
+
UserClouds Authentication is a resilient, privacy-aware login provider that supports simultaneous use of multiple identity providers.
13
+
14
+
Unlike other login providers, UserClouds offers:
15
+
16
+
-**Best-in-class reliability**: UserClouds lets you use primary and back-up user stores simultaneously. This vastly reduces your downtime since you always have redundancy in the system.
17
+
-**Easy, downtime-free migration**: UserClouds plugs into existing authentication flows, like Auth0 or Cognito, and steadily replicates your users' information as they log in. Once the stores have converged, you can migrate to UserClouds's User Store with zero downtime or data loss.
18
+
-**Compliant data storage**: Global privacy regulation often requires sensitive user data to be stored in the user's home country. Unlike other providers, UserClouds can store sensitive information in distributed databases - protecting you from regulatory fines.
19
+
20
+
This documentation shows you how to:
21
+
22
+
- Create an application with authentication by UserClouds in less than 5 minutes
23
+
- Set up and customize UserClouds for your own application
24
+
- Add to UserClouds your software, with zero downtime
createdAt: "Thu Aug 03 2023 22:51:23 GMT+0000 (Coordinated Universal Time)"
10
+
updatedAt: "Fri Aug 25 2023 21:43:12 GMT+0000 (Coordinated Universal Time)"
11
+
---
12
+
UserClouds supports every major method of authentication, such as social sign in with Google, Facebook and LinkedIn OAuth. The user's accounts will be owned by the Identity Platforms configured in “Underlying Identity Providers”.
13
+
14
+
Adding a Social/Third Party Connections to a login flow can be completed in three steps:
15
+
16
+
1. Create/configure your account directly with the third party (new connections only)
17
+
2. Connect your tenant to your third party account
18
+
3. Turn on that authentication method in your application
19
+
20
+
## 1. Configure your account with the third party
21
+
22
+
To set up third party OAuth for the first time, you'll need to create your account with the third party providers directly. For more info on this, see the articles below:
23
+
24
+
-[Setting up Google OAuth](https://support.google.com/cloud/answer/6158849?hl=en)
25
+
-[Setting up Facebook OAuth](https://developers.facebook.com/docs/facebook-login)
26
+
-[Setting up Apple OAuth](https://developer.apple.com/sign-in-with-apple/get-started/)
27
+
28
+
## 2. Connect your tenant to the third party
29
+
30
+
Once you have set up your relationship with the third party OAuth provider, it's time to connect your tenant to that provider:
31
+
32
+
- Go to your Tenant’s Authentication page.
33
+
- Select the relevant provider in the Social & 3rd Party Identity Providers card
34
+
- Copy over your OAuth Client ID and Client Secret
35
+
- Click Save!
36
+
37
+
## 3. Turn on the authentication method in your application
38
+
39
+
Now your tenant is connected to the third party, you can add their authentication method to any applications within that tenant. This allows you to serve different login experiences to different users within the same tenant. For example, Uber might prefer to have drivers and riders served by the same tenant, since a driver wants their password to work for both apps. But Uber might also require 2FA for the driver app, since drivers payouts are configured through the driver app.
40
+
41
+
1. Navigate to the Application page (Select Tenant > Authentication > Application)
42
+
2. Create social redirect and logout URIs for that application, e.g. `https://tenantname.tenant.userclouds.com/social/callback`
43
+
3. Add these URIs to your account with the third party (see links in part 1)
44
+
4. Select which authentication methods are enabled in the Login Settings card. You can also configure other authentication methods, like Passwordless / Magic Link, from this card.
createdAt: "Thu Aug 03 2023 22:59:37 GMT+0000 (Coordinated Universal Time)"
10
+
updatedAt: "Fri Aug 25 2023 21:45:12 GMT+0000 (Coordinated Universal Time)"
11
+
---
12
+
## Email Types
13
+
14
+
UserClouds sends seven types of emails to your users.
15
+
16
+
1. Invite Existing User
17
+
2. Invite New User
18
+
3. Verify Email
19
+
4. Passwordless Login
20
+
5. Reset Password
21
+
6. Multi-Factor Authentication Email Verification
22
+
7. Multi-Factor Authentication Email Challenge
23
+
24
+
## Customizing Emails
25
+
26
+
You can customize each email in the Email Experience Card on your Application Settings page. You can customize:
27
+
28
+
- Sender Email Address
29
+
- Subject
30
+
- Email Body
31
+
32
+
## Formatting Emails
33
+
34
+
The text input for the email body is HTML-enabled, to allow linking out to pages like your Terms of Service or Privacy Policy pages. However, the only accepted HTML elements are:
35
+
36
+
-**Paragraphs**: `<p>``</p>`
37
+
-**Hyperlinks**: `<a>``</a>` with the href attribute
38
+
-**Line breaks**: `<br>``</br>`
39
+
40
+
## Personalizing Emails
41
+
42
+
You can also add parameters to the email, using the format `{{varName}}` or by clicking the suggested parameters at the bottom of each input box.
createdAt: "Thu Aug 03 2023 22:56:11 GMT+0000 (Coordinated Universal Time)"
10
+
updatedAt: "Fri Aug 25 2023 21:43:36 GMT+0000 (Coordinated Universal Time)"
11
+
---
12
+
You can customize your login UI in the Login Experience card of the Application Settings Page. This is reached by selecting the Application in the Authentication page. You can preview your changes before you push them to live in the screen preview on the right-hand side.
13
+
14
+
## Page order
15
+
16
+
To show your social sign on buttons above the email input, select “Social first” under Page Order in Authentication Settings.
17
+
18
+
## Logo and colors
19
+
20
+
You can add your logo and brand colors in the Login Experience card. We recommend using a square, transparent png file up to XxX pixels. The colors section allows you to configure your button fill, text and border, as well as the background color of your login screen.
21
+
22
+
## Login and sign-up page copy
23
+
24
+
You can customize the Header, Subheading and Footer copy of the login and signup pages. By default, these are set to:
25
+
26
+
-**Header**: _“Sign in to [appname]” / “Create an [appname] account”_
27
+
-**Subheading**: [blank]
28
+
-**Footer**: _“By continuing, you agree to our Terms of Service and Privacy Policy”_
29
+
30
+
The text input for the footer is HTML-enabled, to allow linking out to pages like your Terms of Service or Privacy Policy pages. However, the only accepted HTML elements are:
31
+
32
+
-**Paragraphs**: `<p>``</p>`
33
+
-**Hyperlinks**: `<a>``</a>` with the `href` attribute
0 commit comments