I am implementing Authentication from scratch (php).

I reached a point where I have different types of users (admin, author, editor etc.)

After dealing with this, I realized I can allow multiple account login at the same time (the login pages/paths are different for each user type).

  1. Would it be a good idea to implement multiple account login (with different user types)?

  2. How about having same user type multiaccount, is it a good feature, or just a waste of time?

Number 2 is similar to what gmail has (multiple accounts, allows you to switch between account, even has an All mails across all accounts page)

  • Since I cannot create new tags, maybe someone else can create one, such as multiple-login etc.
    – DonJoe
    Jan 10, 2019 at 23:44
  • Can a single account have multiple types? Can I be an admin and author? Or do you require a single user to create two unique accounts/logins?
    – Cole Ole
    Jan 11, 2019 at 0:13
  • @ColeOle 1 email = 1 account. The type of account does not matter. 1 account can be of only 1 type
    – DonJoe
    Jan 11, 2019 at 0:16
  • 1
    So if I were to use my [email protected] email for the 'author' login, in order to also login to the 'editor' part, I would need to create a new email and account?
    – Cole Ole
    Jan 11, 2019 at 0:22
  • 1
    I think you already answered your own question - for some applications it may be useful, for others not. For example, if you have to work with a CMS, you have to login with an account which has specific access rights. But after manipulating content, you might want to validate how the related web pages will look when using a standard or guest account.
    – Doc Brown
    Jan 11, 2019 at 22:22

1 Answer 1


Basic Login: Authentication, and Authorisation


...is the first door, it is the act logging in.

  • The user enters an identifier like a Username or email, along with an authenticator like a password.
  • The application creates a session for them, with some sort of expiry.


...checks to see if the current session is allowed to perform a given action, or access certain data.

The session is checked against some rules like:

  • the user is logged in,
  • the user has admin privileges,
  • the user last authenticated less than 10 minutes ago.

And if that is all good the access/usage is permitted.

But... If it doesn't you have a choice: Reject, or Obtain Extra Authority.

Rejection is simple, stop the user, they are not allowed.

Obtaining extra authority is a little harder, maybe the user logged in twenty minutes ago. Technically they have the privileges needed, you just want to be sure they are still sitting at the computer. So instead the application asks them to log in again, before attempting to authorise them and let them continue on.

Multiple Sources of Authentication

Often it does not make sense to have a single method for authenticating a user:

  • Password recovery by sending an email/sms to a known contact point
  • Extra security by requiring additional passwords/key/biometric
  • Integration with a cross-client identification provider

Each of these can be represented by a kind of authenticator. The procedure would be:

  1. Attempt to identify if the user is already authenticated. If they are, obtain the relevant details and jump to step 4.
  2. Direct the user to an appropriate authenticator, eg: request a specific authenticator, or provide a list of options
  3. The user attempts to authenticate by providing credentials somehow. eg: Perhaps they are redirected to an external site where they can authenticate, and that external site responds forward with an authenticator token.
  4. Once an authentication has been successful, the kind of authentication, the time, an tokens, etc... are noted down. This will feed forward to the authorisation logic which determines what can be seen and done.

There are a few sticking points here:

  1. An authenticator may not actually require whoever is using the client to have supplied credentials.
  2. Several authenticators may contradict each other on what the identity of whoever is using the client really is.


Sometimes an authenticator might acknowledge a user without requiring credentials. This may be okay when permitting access to some relatively benign information like: add to wish list. Conversely providing access to see that wish list could be considered harmful, afterall not everyone should just be able to see a persons wishes. In such a case the authorisation logic should reason that the account holder might not actually be the current user, and challenge them to prove their identity by requiring credentials to be entered.

Conflicting Authentication

When the user accesses the application there is a chance that they have multiple accounts with your site each tied to a different authenticator. In these cases the best strategy is to ask the user to login and present credentials, without pointing out which identity services/authenticators were in actual conflict. This provides two benefits:

  • The user picks the account the wish to engage with,
  • and no other user can infer who else uses the application, or how many accounts they have.

In general it a good idea to not auto-login a user unless they have agreed to that behaviour.

  • 2
    I don't think you understood my question
    – DonJoe
    Jan 11, 2019 at 4:08
  • @DonJoe, I think I do. You have users, they have specific but different privileges in the system. Some of your users need to have privileges for being both an author and an admin (maybe more). The way to achieve this is to separate the two problems. This way a User is just a User, they login in just once but this does not mean they can access just any page, for this they need the right privilege. This is what the page/api does. It looks at the user and checks to see if that user has the necessary privilege. If they do let them through, otherwise redirect/reject them.
    – Kain0_0
    Jan 11, 2019 at 4:21
  • I am not worried about user privileges. I am just asking does it have any benefits (even academic) to implement multiaccount login? Basically, this means using the same app to sign multiple accounts (it is implemented a lot on mobile apps), so you can easily switch between apps, even use some functions like I said in the question "view all mails across all accounts". Instagram has thin feature, FB has this feature etc.
    – DonJoe
    Jan 11, 2019 at 13:48
  • @DonJoe, ah much clearer. It seems that the terminology is off by one. An account is a story about the history, and future of interactions between some client, and the system. An authenticator is a way for the client to identify which account in a system it is associated with in such a way that the system is reasonably sure that this client, and the client of the account are one and the same. So what your question is, is can an account be associated with multiple authenticators? Yes it can.
    – Kain0_0
    Jan 13, 2019 at 23:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.