Login Form

Sign-in · Web login · User authentication

Tags:authentication

Examples

U-Campus login page, where the student enters their institutional username and password to access the academic system (Spanish-language interface).

Description

A component that lets human users identify themselves to the system through a web interface in order to access personalized functionality. The system presents an identification form, validates the supplied credentials against a user base, and establishes an authenticated session that allows the user to interact with the system.

Mandatory capabilities

Mandatory capabilities

• Presents a graphical web interface (HTML form, login page) for the user to enter their credentials
• Verifies the credentials against a user repository (local database or external identity provider)
• Establishes an authenticated session through cookies, JWT tokens, or similar mechanisms
• Gives the user feedback on the result of the authentication (success, error, locked account)

Additional capabilities

Additional capabilities

• Remember me: keeps the session open between visits through long-lived cookies, so that the user does not have to re-enter credentials on every access
• Access recovery: lets users who forgot their password recover it through a flow that is reachable without prior authentication, typically by sending a link or code by email
• Lockout after failed attempts: temporarily restricts access after multiple consecutive failed attempts, mitigating brute-force attacks
• Anti-bot CAPTCHA: adds challenges to tell human users apart from automated bots

Boundaries

What it is not

• Does not include the management of permissions or roles — that belongs to Authorization
• Does not include creating, modifying, or deleting user accounts — that belongs to Account Creation and Profile Management

Information flow

Input

User credentials (email/username + password, or the selected SSO provider)

→

Output

Authenticated session (session cookie, JWT token) or error message. Redirect to the home page.

Variants

• Traditional username + password: a form that asks for a username or email and a password
• Single Sign-On (SSO): delegation of authentication to external providers such as Google, Microsoft, or Facebook
• Two-factor authentication (2FA): requires a second factor in addition to the password (OTP code, SMS)
• Magic link / Passwordless: a one-time link sent by email that authenticates without a password

Typical dependencies

• User repository (Database or an external identity provider such as Auth0 or Okta)
• Session or token manager (cookie system or JWT)
• Notification service (Notification System for password recovery and magic links)
• Account Creation and Profile Management (the components that create and maintain the accounts authenticated here)

Mapping to the Digital Board

Manual UpdateNo

Automatic UpdateNo

Data ConceptsAlways

On-Demand OutputsNo

Automatic OutputsOptional

Autonomous ProcessesNo

Section	Relationship	Notes
Manual Update	No	The credentials entered by the user are transient input used to verify their identity; no persistent data of the system is stored or modified.
Automatic Update	No	—
Data Concepts	Always	User (consumed to verify identity). Session, when the system stores sessions on the server side.
On-Demand Outputs	No	—
Automatic Outputs	Optional	Password-recovery message. Notification of suspicious activity.
Autonomous Processes	No	—

Digital Board example

Manual Update

—

Data Concepts

User

Session

On-Demand Outputs

—

Automatic Update

—

Autonomous Processes

—

Automatic Outputs

Password Recovery Email