Salesforce B2C Commerce 24.7 > B2C Commerce Security Guide > Security Best Practices for Administrators > Authentication and Authorization

User Authentication and Authorization

As an administrator, you configure security controls in Business Manager. You need to perform authentication to determine if the Business Manager user is who they claim to be. You can also perform authorization to determine if the user has permission to perform the specific action they are attempting.

  • User Authentication
    Always use unified authentication in Salesforce B2C Commerce if you are an administrator. Traditionally, we always used local user authentication, but a local user can perform only a local login into the Business Manager instance on which their credentials were created. After a site migrates to unified authentication, the site requires unified authentication on Account Manager, where a user can perform a global login into any Business Manager instance in their organization.
  • User Authorization
    Salesforce B2C Commerce uses role-based access control to perform authorization. A user is assigned one or more roles, with each role consisting of a set of permissions. User authorization is configured in Business Manager using custom roles and permissions. The process primarily works the same way regardless of whether you use local or unified authentication.

Infocenter Retirement: On June 30, 2023, the Infocenter was retired, and documentation currently hosted on the Infocenter will be published to Salesforce Help, Commerce Cloud Developer Center, and Salesforce B2C Commerce Developer Documentation Resources. For more information, see the release note.