RFC: Improve login

[donker]

Description of problem

The login experience has remained untouched for years and shows its age:

1. It takes forever to load which is especially noticeable when you use the popup
2. When clicking login the form sits there while the user is being logged in - the user should see some sort of spinner
3. It's not responsive (issue RFC: Mobile Friendly Login, Enhance Existing or New Module #2469)
4. The "keep me logged in" checkbox is below the login/cancel buttons - this should be above
5. It is difficult to style/adapt given the nr of fixed classes - it should be templateable

Description of solution

To attack problems nr 1 and nr 2 we could look at preloading a login screen. The complexity is that your page may be http and you want the login to be https. But we could consider having an improved experience only for sites that implement https and then go through a web api call to log in. This would allow us to do all the user feedback at the front end which makes things simpler.

To attack 3-5 we need to look at making this templateable. The complexity is that this control is extensible and auth providers can hook in. But IMHO this shouldn't trump us moving forward to improve this. One solution I've had some luck with is the use of a razor template inside the skin folder which describes how the login panel looks including the optional components.

[kurtwilbies]

@donker
Can you share your (customized) solution. I actually hope this problem will be solved in 9.3. Login is the hart of each (secure) app.

[jeremy-farrance]

Please also -

1. we need to have the option to unhook this 'login thing' from targeting the current page's Skin and ContentPane. Maybe there should be some settings at the Site (Portal) level that provide some choices about how the Event (user suddenly needs to authenticate) is handled and routed. What I am trying to say is it needs to uncouple from the current skin/pane logic and become its own thing with an OPTION (host and site level) to still happen the old way (which could/should be the natural default for the next few versions). The new, default end result needs to be simple and generic and work with the existing providers.

2. please do not forget being able to login without a mouse. The tab order moving between fields needs to be logical and pressing enter needs to submit.

[valadas]

I remember on older dnn versions, you had an option of enabling or disabling popups. With popups enable it would center the dialog on the screen. Was that intentionally remove or was it just a forgotten option in the Persona Bar site settings?

[thabaum]

It would be nice to have a two part authentication option that sends a message to email with pin to log in if enabled in host and in user account for added security option. Possibility for SMS messaging as well. The email sending a pin I think would be a more basic and simple way to add one more level of security.

Option for Google reCaptcha that uses the checkbox style checker for registration or login if set.

Common popular authentication providers working with latest logos and login buttons that work with theme.

[moorecreative]

++ on the comment for having 2-part authentication as an option, that would be a great feature!

[kurtwilbies]

2-part auth is nowadays a must. My vote.

[mitchelsellers]

Any two factor implementation should be provider, or interface driven so that new methods can be implemented. For example SMS which isn’t practical without other config etc.

[sleupold]

IMO, points 1 to 5 are nobrainers and should be fixed

[MaiklT]

Please please please add 2-factor authentication (e.g. using Google Authenticator)

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.