Customer Portal Access and Authentication

Customer Portal access should be controlled according to the identity and authentication requirements of the Helpdesk.

Authentication

When portal content or customer records require authentication, the customer must sign in using the supported authentication process.

Customer identity

The Helpdesk should associate the authenticated user with the correct customer or contact context.

Identity should not be inferred from untrusted information when protected data is involved.

Access to tickets

Customers must only be able to access tickets permitted by the portal's authorization rules.

A customer must not be able to retrieve another customer's private ticket by changing a URL or identifier.

Session security

Customers should sign out when using shared devices and protect their authentication credentials.

Failed access

If a customer cannot access expected portal content, verify the account, authentication state, contact relationship, and applicable access rules.

Good practices

Test protected portal routes using multiple customer identities when validating access-control changes.