Business user authentication. How?

[Kevin]

Hi.

A client of ours wants some "b2b customer-only" pages on his site. I looked at the AUG's suggestion of using redirection via Javascript, and/or a META refresh, but this isn't robust enough.

I thought about sniffing the cookie vars, but I can't see any difference between cookies belonging to logged-in users, and cookies belonging to not-logged-in users. I see the session file is created as owner write-only too, so my script won't be able to poke around in there.

So... Can anyone suggest a method to determine, server-side, whether we have a logged-in user or not?

The other thing is - if I'm going to have to do this authentication myself outside of Catalog - what do I need to consider as far as maintaining this user's state? Will it be OK just to link back to the bb000001.pl script from my external pages and let it carry on, assuming I leave the cookie and session file unchanged?

Any help much appreciated.

[cdicken]

I'm afraid I don't know about sniffing around cookies, but there are some 'ShowForPriceSchedule' tags available in Actinic which may help you out.

Check out http://knowledge.actinic.com/users/k...33.html#aGC134 and there's a nice little application of it here: http://knowledge.actinic.com/users/k...99.html#aCD345

[Kevin]

Eek! That's going to be a bit troublesome to hide a whole HTML page, but I suppose it's beats poking around in the authentication system myself.

Thanks Chris.

[cdicken]

You are not hiding an entire HTML page - just the link to it. You can then back this up with the meta refresh bounce code in case people find their way into it. And then make all the products within it not visible to retail customers.

[Kevin]

Ah, I see. Given that this is going to mean editing the template each time the client creates a new Price Schedule, I don't think it's going to be worth the hassle to use. I was hoping for something that would include/exclude page content (inc. the results of variable placeholders, ie: BULK) based on the customer's status. Something like the NOTINB2B, but without the NOT.

Given that Catalog-generated pages aren't truly "dynamic" I figured I'd have to do this myself outside of Catalog, which is fine, but I'm still stuck trying to figure out the authentication system...