---
documentId: UFS-003
title: "Login"
helpVersion: 1.0.0
lastUpdated: 2026-09-05
---
# Login
> **UFS-003 ยท UFS Help Center**
> This guide is maintained as versioned Markdown and is optimized for on-screen reading and printing.
### UFS Login & Secure Account Access Guide
How to reach Login, understand every control, use password visibility safely, stay signed in, and understand what UFS does after you select Login
### Purpose of This Page
The Login page is the secure entry point to an existing UFS identity. It validates your credentials, checks account status, preserves the intended destination when appropriate, and then returns you to the correct UFS workspace. This guide describes the current implementation in the latest UFS checkpoint.
Universal Facility System (UFS) | User Guide
## 1. How Do You Reach the Login Page?
UFS exposes the Login page through the /login route. Users can reach it naturally from several parts of the public and authentication experience:
- Select Login from the Landing Page. The Landing Page builds a login URL that normally returns the user to
/dashboard and can preserve the selected Category.
- Select Login from the public UFS footer.
- From Register / Create Account, select the Login link shown for users who already have an account.
- After successful email confirmation, select Continue to Login.
- Invitation and relationship flows can redirect an unauthenticated user to Login while preserving a ReturnUrl
and, in some cases, the expected Username.
- Open /login directly in the browser.
### Direct Access
The route is /login. The page can also receive query-string values such as returnUrl, userName, categoryId, and error. These values are used to preserve context and display the appropriate login state.
## 2. What Does the Login Page Communicate?
The page is split into two visual areas. The dark UFS identity panel explains the purpose of signing in, while the light form area contains the actual authentication controls.
### Left Identity Panel
- Welcome back - positions Login as a return to an existing UFS identity.
- Your UFS workspace is ready when you are - emphasizes continuity rather than creating a new account.
- Secure account access - your account and role determine what workspace and tools are available.
- One connected workspace - the same identity connects personal, Facility, and professional activity.
- Continue where you left off - Login restores access to UFS relationships, messages, work, and
opportunities.
- Security reminder - use UFS credentials only on trusted devices and keep the password private.
3. Complete Guide to the Login Controls
| Control | Status | What UFS Does | User Guidance |
| --- | --- | --- | --- |
| Username | Required | Posted as UserName. Leading
and trailing spaces are
removed on the server before
lookup. | Enter the Username
associated with the UFS
account. |
| Password | Required | Posted as Password and
passed to ASP.NET Core
Identity for password
verification. | Password characters are
hidden by default. |
| Show / Hide Password | Optional UI control | Changes only the browser
input type between password
and text. It does not change or
submit the password. | Use briefly to verify typing,
then hide it again. |
| Remember Me | Optional | Passed to | Use only on a trusted personal |
Universal Facility System (UFS) | User Guide
| | | PasswordSignInAsync as the
persistence choice for the
authentication cookie. | device. |
| --- | --- | --- | --- |
| Login | Required action | Submits the form by POST
to /api/auth/login. | Select after Username and
Password are entered. |
| Create an account | Navigation | Takes users without an
account to Register and
preserves Category context
when available. | Use this instead of Login if you
do not yet have a UFS
account. |
| Help (?) | Navigation | Opens the Login guide in the
UFS Markdown Help Viewer.
The configured source is
UFS-003-Login_Guide_EN.md. | The file must exist under the
UFS.Shared help static-
content path for the link to
display the guide. |
## 4. Username Behavior
The Username field uses autocomplete="username" and can be pre-filled from a userName query-string value. This is useful when another UFS flow already knows which account is expected, such as an invitation acceptance flow.
On submission, the server trims surrounding spaces and searches for the account by Username. If no matching Identity user exists, UFS returns to Login with an invalid-credentials error rather than revealing whether a specific username exists in a more detailed way. 5. Password and the Show / Hide Control The Password field uses autocomplete="current-password" and is masked by default. The eye icon inside the field is a Login-only control. Its CSS is scoped to Login.razor.css so the Register / Create Account layout is not affected.
- Select the eye icon to change the input from password to text.
- The icon changes from eye to eye-slash while the password is visible.
- The aria-label and title change between Show password and Hide password for accessibility.
- Selecting the control does not submit the form because the button type is button.
- After toggling, focus returns to the password field and the cursor is moved to the end of the current value.
### Security Note
Show Password is a convenience feature only. It does not bypass authentication and does not expose the password to UFS differently; it merely makes the already-entered browser value visible on screen. Avoid using it when another person can see your display.
## 6. Remember Me and Session Behavior
Remember Me is optional. When selected, the server passes a persistent-sign-in choice to ASP.NET Core Identity. The application cookie is named .UFS.Auth, is HttpOnly, uses SameSite=Lax, has an 8-hour expiration window, and uses sliding expiration. Secure-cookie behavior remains strict outside the special QA non-proxy case defined in configuration.
Universal Facility System (UFS) | User Guide
### When Should I Use Remember Me?
Use it on a trusted personal device when you want the authentication session to persist more conveniently. Do not use it on a shared, public, kiosk, or borrowed computer.
## 7. What Happens After You Select Login?
1. The browser submits Username, Password, ReturnUrl, CategoryId, and RememberMe to POST /api/auth/login.
2. UFS rejects the request if Username or Password is empty.
3. UFS looks up the Identity user by Username.
4. UFS checks whether the user is a special KioskUser and, if so, validates the Facility kiosk setting before routing that identity to the kiosk experience.
5. For normal users, UFS loads the related UserAccount and rejects deleted, inactive, or non-Active accounts.
6. ASP.NET Core Identity validates the Password. Failed attempts count toward lockout.
7. If authentication succeeds, UFS records LastLoginAt in UTC.
8. UFS chooses the redirect destination. A valid local ReturnUrl is honored; otherwise /dashboard is used.
9. If a valid CategoryId was supplied, UFS adds it to the redirect URL so the selected category context can continue after sign-in. 8. Email Confirmation and Account Eligibility The current Identity configuration requires confirmed email before sign-in. This means a newly registered user must complete email confirmation before a normal successful Login. In addition, the UFS UserAccount must exist, must not be deleted, must be active, and must have Active status.
### Important
A correct Username and Password are not the only requirements. Account state and the current Identity security policy are also part of the sign-in decision.
## 9. Failed Attempts and Lockout Protection
UFS enables lockout for new users. PasswordSignInAsync is called with lockoutOnFailure=true. The current policy allows five failed access attempts before a 15-minute lockout period.
- Maximum failed access attempts: 5.
- Default lockout time: 15 minutes.
- A failed password attempt contributes to lockout protection.
- Do not repeatedly guess a password. Use the appropriate account-recovery process when available.
10. Login Errors and What They Mean
| Message / Condition | Meaning | Recommended Action |
| --- | --- | --- |
| Missing credentials | Username or Password was empty. | Enter both fields and try again. |
Universal Facility System (UFS) | User Guide
| Invalid credentials | Username was not found, password
validation failed, or Identity rejected sign-
in. | Verify Username and Password. If
repeated attempts fail, avoid triggering
lockout. |
| --- | --- | --- |
| Account not found | The Identity user exists, but the related
UFS UserAccount record is missing or
deleted. | Contact the appropriate UFS
administrator/support path. |
| Account inactive | The UFS account is disabled or its status
is not Active. | The account must be reactivated by an
authorized process. |
| Login failed | Fallback message for an unrecognized
error query value. | Retry carefully or seek support if the
condition persists. |
| Kiosk disabled | The endpoint can produce kiosk disabled
_
for a KioskUser whose Facility has kiosk
attendance disabled. The current Login
page does not have a dedicated mapping
and therefore falls back to the generic
Login failed message. | Facility configuration must be corrected if
kiosk access is expected. |
## 11. ReturnUrl and Safe Redirect Handling
Login can preserve the page that originally required authentication. The default destination is /dashboard. If returnUrl is supplied, the server accepts it only when it is local to UFS. External absolute URLs are not accepted. This reduces the risk of using Login as an open redirect to another site.
The current local-URL check accepts a normal single-slash local path (for example /dashboard) and the ~/ form, while rejecting protocol-relative values such as //example.com. 12. Category Context After Login The Login page can receive categoryId. The value is posted back as a hidden field. After a successful normal sign-in, a valid non-empty GUID is appended to the redirect URL. This allows a Category selected before authentication to remain part of the user journey after Login. 13. Special Kiosk Login Behavior UFS checks the user roles before the standard UserAccount flow. If the identity has the KioskUser role, the endpoint resolves the related Facility role and FacilitySetting. If kiosk attendance is disabled, login is rejected. Otherwise the user is redirected to /kiosk/{userId}.
### Why This Is Different
Kiosk identities follow a specialized operational path and do not use the normal dashboard redirect. This behavior is intentional and is controlled by Facility kiosk configuration.
## 14. The Help Button
The question-mark Help button is positioned at the top-right of the authentication layout for Login and Register. On Login it opens the configured English guide in a new tab with rel="noopener noreferrer" and enhanced navigation disabled.
Configured Markdown path: `_content/UFS.Shared/help/UFS-003-Login_Guide_EN.md`
### Deployment Requirement
The Login Help button is already wired to the filename above. The PDF must be placed in UFS.Shared/wwwroot/help with that exact filename for the browser to open this guide successfully.
## 15. Privacy and Safe Login Practices
- Use UFS only from a trusted browser and device when possible.
- Never share your Password with another person.
- Use Show Password only when your screen is private.
- Avoid Remember Me on shared devices.
- If a Login repeatedly fails, stop guessing before the account reaches the lockout threshold.
- Confirm that the browser address is the expected UFS domain before entering credentials in production.
- Sign out when you are finished on any device that other people can access.
16. Recommended Returning-User Journey
1. Open UFS and select Login.
2. Confirm that you are on the expected UFS Login page.
3. Enter your Username.
4. Enter your Password. If needed, briefly use the eye icon to verify what you typed, then hide it again.
5. Select Remember Me only on a trusted device.
6. Select Login.
7. If UFS opened Login from another protected page, allow it to return you to that local destination. Otherwise continue to the Dashboard.
8. If an error is displayed, correct the condition rather than repeatedly retrying the same credentials.
17. Implementation Reference This guide was prepared from the current UFS source checkpoint and the current Login screen. The main implementation files reviewed were:
- UFS.Shared/Pages/Auth/Login.razor - Login form, query parameters, UI error mapping, Register link, and
hidden ReturnUrl / CategoryId values.
- UFS.Shared/Pages/Auth/Login.razor.css - Login-only password-visibility styling.
- UFS.Shared/wwwroot/js/ufs-login-password-toggle.js - Show / Hide Password behavior.
- UFS.Shared/Layout/AuthLayout.razor - Login identity panel and Help-button PDF link.
- UFS.Web/Endpoints/AuthEndpoints.cs - server-side Login endpoint, account-state checks, kiosk routing,
password sign-in, LastLoginAt update, and redirect handling.
- UFS.Web/Program.cs - Identity confirmation, lockout, password policy, token lifetime, and authentication-
cookie configuration.
Universal Facility System (UFS) | User Guide
## 18. Quick Summary
### In One Sentence
Login is the secure gateway back into an existing UFS identity: enter your Username and Password, optionally keep the session persistent on a trusted device, let UFS validate account and security state, and then continue to the appropriate workspace.
Universal Facility System (UFS) | User Guide