Graduated authentication for user accounts

One of our clients needed to migrate all their customers to another entitlement service, requiring them to create new Single Sign-On (SSO) accounts. Concerned that many customers might struggle with the SSO setup process and overwhelm the customer support team, Mugo designed a "graduated authentication" system that dynamically balanced temporary free access with required account creation, allowing our client to manage customer support workload in real time. Instead of forcing all customers to the SSO setup at once, a smooth transition was implemented, providing immediate support for anyone who needed it.

Migrating to a different authentication system is not a simple task. It can quickly become a nightmare when the new system requires all users to go through a multi-step process to create a new Single Sign-On (SSO) account, including email verification.

Initially, our client attempted a hard transition by setting a launch date for the new authentication system and giving customers time to create their accounts in advance. Unfortunately, many users ignored the warnings and waited until authentication became mandatory, resulting in an overload for the customer service team. Many customers were unable to complete the SSO setup process and, as a result, could not access the site's content.

Special considerations were needed to ensure users had the guidance and support needed to complete account creation, while also allowing the customer service team to manage the increased demand during the transition period. Until a viable solution was established, the site's paywall was temporarily removed, and the content was made freely available.

The client's proposal

The client’s team proposed a “spread-out login” approach. Their idea was to select 7-10% of customers per day for SSO account setup while granting free access to the remaining users. The goal was to limit the number of users going through the setup process at any given time and help keep customer service calls at a manageable level. They suggested giving three weeks of free access to everyone, and building logic that would make login sessions expire only on weekdays in the following month. As the session expires, the users will be automatically forced to authenticate their access and eventually set up an SSO account.

As you can imagine, this approach had some critical points to consider:

• Users without prior access would be immediately prompted for SSO account creation.
• There was no guarantee users would visit the site on the day their subscriber session expired. That could create days with fewer users and days with more users in the SSO account setup interface, potentially still overloading customer service.
• No logs or insights were available, other than the total number of SSO accounts created.

The spread-out login idea was a good start, but the “how to implement it” required refinement.

Our proposal

To help address those issues, Mugo Web proposed an interface that randomly grants access to content while using a predefined “skip rate” to select users for SSO account setup and giving free access to others. This allowed our client’s team to adjust the skip rate dynamically based on customer service workload:

• If the support team were at capacity, they could increase the skip rate to send fewer users for SSO account setup.
• If the support team had extra bandwidth, they could lower the skip rate to send more users for SSO account setup.

When a user accesses a page with a paywall, the graduated authentication service is triggered. Using an internal counter and the predefined skip rate, the service determines whether the user receives free access or must authenticate.

If the user is selected for free access, the service assigns them a subscriber role valid for 24 hours. This removes the user from the graduated authentication logic for that day and grants full access to the site content.

If the user is selected for authentication, a cookie is created to identify the user and require a valid account to proceed. This prevents users from starting account setup, abandoning it, and later returning to the site to receive free access via the spread-out service. The user can then choose whether a new SSO account is required or proceed with a standard login. After successful authentication, the user receives a subscriber session valid for 30 days. This ensures they are properly handled by the system without re-entering the graduated authentication login process or interfering with users who do not have an SSO account.

Under this logic:

• Users with a valid SSO account and authentication would receive a 30-day session, and are removed from the graduated authentication flow.
• Users selected for SSO account setup would not receive free access and will be required to complete the setup.
• Users given a free day of access would receive a 24-hour session, ensuring that all customers eventually complete SSO account setup.

Custom interface

Mugo Web built an interface that allowed our client’s team to adjust the skip rate and monitor login activity in real time. Logs of previous days were also available to help them compare performance over time and determine the optimal skip rate for each period.

With this interface, they could disable the graduated authentication entirely by setting the skip rate to zero, forcing all users through authentication, or set a high value to grant 24 hours of free access to all users.

Conclusion

Overall, our client was very satisfied with the solution. Initially, they were skeptical that the graduated authentication logic would effectively push all customers to SSO setup while keeping customer service calls manageable. By the first day of testing, they were convinced — adjusting the skip rate allowed them to control the user flow perfectly. The graduated login solution ensured all customers completed SSO setup sooner than estimated, exceeding the expectations of the customer service team.

The strength of having a long-term development partner is having a team at your disposal that understands the ins and outs of your business. At Mugo Web, we specialize in providing custom solutions that perfectly fit our clients’ needs — even needs they didn’t know they had. If you are looking for a developer you can trust to have your business’s best interests at heart, contact us today!