Home
Documentation
This Help Center provides documentation on all aspects of the HCL Commerce+ product, from installation and deployment to operating and customization.
Securing
These topics describe the security features of Commerce+ and how to configure these features.
Commerce+ authentication model
The Commerce+ authentication model is based on the following concepts: challenge mechanisms, authentication mechanisms and user registries.

Documentation
This Help Center provides documentation on all aspects of the HCL Commerce+ product, from installation and deployment to operating and customization.
- Overview
  Welcome to the HCL Commerce+ overview. Explore these feature overviews to learn how Commerce+ operates. Refer to the related links listed at the end of each topic to access expanded product documentation.
- Deploying
  This section provides details on deploying HCL Commerce+. It explains how to download the Docker images and Git bundles that comprise the product, how to create a minimal environment, and how to plan for a full deployment. It details supported software versions, patches, and configurations to ensure the platform performs well.
- Migrating
  The following topics show how to migrate an existing HCL Commerce Version 9.1 environment to Commerce+. The process consists of an initial migration of your database contents. This is followed by a code migration. Both are fully described.
- Operating
  The topics in this section focus on tasks that are performed by business users, marketers, and customer support representatives to connect with partners and attract and satisfy customers.
- Administering
  The site administrator performs the tasks needed to support day to day operations of the Commerce+ site.
- Extending
  Using Commerce+'s xC programming model, you can use HCL-provided extension points to extend existing Commerce logic. You can implement these extensions with the xC Customization toolkit provided by HCL. Commerce+ also provides Packaged Business Capability integrations that extend the product's reach and functionality.
- Securing
  These topics describe the security features of Commerce+ and how to configure these features.
  - Non-applicable security vulnerabilities
    The Commerce+ team has evaluated the following security vulnerabilities identified within the Commerce+ stack and determined there is no impact to default deployments.
  - Commerce+ security model
    Authentication is the process of verifying that users or applications are who they claim to be. In an Commerce+ system, authentication is required for all users and applications that access the system, except for guest customers.
  - Commerce+ authentication model
    The Commerce+ authentication model is based on the following concepts: challenge mechanisms, authentication mechanisms and user registries.
    - Credentials
      The Transaction server supports authentication mechanisms based on validating credentials, such as certificates, tokens, or user ID and password pairs. Credentials are verified against a user registry that supports such a scheme.
    - Authentication policies
      An authentication policy is a set of rules that are applied to the authentication process and to the verification of authentication data by Commerce+. Commerce+ supports account policies and other authentication-related policies, as described in the following subsections.
  - Authorization
    Commerce+ views access control or authorization as the process of verifying that users or applications have sufficient authority to access a resource. This section describes the details of several aspects of Commerce+ access control.
  - Hardening site security checklist
    To harden the security of your HCL Commerce site, you can enable and configure various security features. In addition, site customizations must always be made to comply with best practices as outlined in this document.
  - Site security considerations
    To enhance the security of your Commerce+ site, you can enable various features in Administration Console or in the Commerce+ configuration file.
  - Session management
    Browsers and e-commerce sites use HTTP to communicate. HTTP is a stateless protocol, which means that each command is run independently without any knowledge of the commands that came before it. Because it is a stateless protocol, sessions must be managed between the browser side and the server side.
  - Quick reference to user IDs, passwords, and Web addresses
    Administration in the Commerce+ environment requires a variety of user IDs. These user IDs along with their requisite authorities are described in the following list. For the Commerce+ user IDs, the default passwords are identified.
- Performance
  Topics in the Performance section describe the means by which to plan, implement, test, and re-visit the optimization of Commerce+ site performance.
- Troubleshooting
  Topics in the Troubleshooting section highlight common issues that are encountered with Commerce+, and how they can be addressed or mitigated.
- Reference
  Topics in the Reference section contain all of the Commerce+ reference documentation.

Commerce+ authentication model

The Commerce+ authentication model is based on the following concepts: challenge mechanisms, authentication mechanisms and user registries.

Challenge mechanisms
Authentication mechanisms
User registry

Challenge mechanisms

A challenge mechanism specifies how a server challenges and retrieves authentication data from a user. Commerce+ supports the following authentication methods or challenge mechanisms:

Form-based or custom authentication: This authentication mechanism permits a site or store specific login through an HTML page or a JSP form.

Authentication mechanisms

An authentication mechanism verifies user authentication data against an associated user registry. Commerce+ issues an authentication token that is associated with a user on every subsequent request after the authentication process. It is terminated when the user logs off or closes the browser.

Database authentication: This is the process of verifying that the logon ID and password supplied by the user are valid when compared to the authentication information stored in the Commerce+ database.
Third-party authentication: This is the process of verifying the logon ID and password supplied by the user against a third-party user registry.

To configure the authentication mechanism to be used by your Commerce+ instance, set the following attribute in the instance configuration file:

MemberSubSystem/AuthenticationMode

Where applicable values are:

DB for database authentication.
OTHER for third-party authentication.

User registry

The user registry is a repository that contains user information, and the user's authentication information (for example, the password). Authentication information provided by a principal (that is, the representation of a human user or system entity in a user registry) can be verified or validated against the user registry.

Commerce+ supports user registries based on the Commerce+ database.

Identity service

Commerce Lab uses the Identity service (SaaS) to log in. The Identity service uses Keycloak as its identity provider. The access token issued by Identity service can then be used to call transaction server APIs as well as the various PBCs, such as INVENTORY. On the other hand, storefront login continues to authenticate to Commerce APIs directly. For more information on Identity service, see Managing business users.