2

I'm working on a website and I want to validate that an individual is an employee at one of a large number of companies (probably using their company's email address, which I don't know before hand). The idea being some users are the general public and others are from these companies. And I need some way to authenticate that the users claiming to be employees are being honest while still having a friendly enough UI.

I did an informal survey of people I know and the domains and emails will match in a majority of cases but they might not always match exactly so you might have a company with a website foo.com and an email [email protected] (although foobar.com did redirect back to foo.com).

And while I can easily check that I'm not sure what other variations might be out there (maybe fooLA.com and email [email protected], etc.)

Improve this question
1
  • 2
    Have the user verify they own the provided email. Outside of doing that, having a user click a link to validate ownership, you will be unable to verify ownership over an email addresses or even a domain both are designed to prevent that.
    – Ramhound
    Aug 21, 2013 at 12:01

4 Answers 4

Reset to default
1

You require a moderation procedure there. You need to work out a user-friendly moderation procedure that may not offend the user claiming to be an employee of a certain company. The best and most credible way to determine is to contact the HR department of that company.

Verifying emails will not be a very credible way to determine whether a certain user is an employee or not. I would rather be sending an email to the registered user claiming to be an employee stating that your application is being moderated and we shall get back to you shortly once moderation is completed.

Improve this answer
1
  • I agree in an ideal world this would be the best way, but what I'm building doesn't have any direct connection to the companies, it's more like a "service" for a particular profession. So, I'm not sure if an HR dept would be reliably cooperative and timely.
    – MCB
    Oct 21, 2013 at 13:34
0

You can let someone with an email under an unregistered domain create a corporate account and verify by replying. If someone at the company doesn't approve of this person creating or being an admin on the account, they can deal with it themselves. Later you can monitor domains setup that do not navy any activity or a minimum number of email addresses registered. I think this is how Yammer worked when I signed up. You could search to see if the company is legitimate as well.

Improve this answer
1
  • The Yammer thing is a good idea but they're not setting up corporate accounts. I thought of the search idea, do you thing using google's api would do the job or checking some other way?
    – MCB
    Aug 21, 2013 at 12:20
0

I think you may opt for LDAP authentication, I did it for Subversion Control System in my company. Good thing about LDAP authentication is that the company will have certain policy to certain group of people. So you wouldn't mess up with your company's policy by using back the existing authentication. In my company, some projects are outsource to vendor, in order to grant them access to access our's SVN, request the admin to create a separate group of ID for them. These vendor ID will only have access to the SVN and say no to the rest. Since you mention web development, you may opt for Spring Security, this framework done a very good job on authentication, LDAP authentication shouldn't be a problem.

Improve this answer
1
  • 1
    He has no affiliation with these companies. They're not going to open up their LDAP servers to him.
    – Isvara
    Jan 19, 2014 at 14:40
0

As in the case of Google Apps For Business (and other Web Apps that have the need to load the profile of a company according to some parameters of the user), you could introduce a step before the log-in.

This first step asks the user a first parameter (the key with the company). During this phase, the system recognizes whether the customer is actually associated with a company. At this point, you can manage different cases.

enter image description here

if (! Company)

Depending on the actual requirements of the business about the case If the client is not associated with any company, maybe you have the following cases:

  1. ..., you can not follow through with the operation of log-in/sign-in;

  2. ..., you will be prompted to fill in a form with other information to deepen the recognition;

  3. ..., it is time to create a new company, with an anonymous profile, which will be filled in later.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.