Internal Authentication

By default, users are authenticated against information stored in the Repository. When users sign in, a salted hash of the user password is generated and compared to the password hash stored for the user in the repository. The user password itself is not stored, and the password cannot be determined from the value of the stored hash.

Passwords are not required for user accounts, by default, but this, like other aspects of the internal authentication process, is customizable. You can specify a custom Sign in page and style it to meet your requirements. You can also configure password and account policies. These policies include whether a password is required, how long a password must be, whether users can change their own passwords, and whether user sign-in information will be remembered.