Sling Authenticator handles authentication requests and calls the registered authentication handlers, including Cortex Authentication Handler to extract the request and drop credentials.

When Cortex Authentication Handler processes and verifies user information, it invokes the login, commit, abort, and logout methods in the registered login modules, including the External Login Module.

The External Login Modules authenticates against the External Identity Providers (CortexIdentityProvider) and syncs the values returned by CortexIdentityProvider into Jackrabbit. Synching creates the user's Cortex profile in JCR and saves information such as the REGISTERED Cortex token that was returned on authenticating the user against Cortex and the token's expiry date under CortexUsers using the Jackrabbit Oak Default Sync Handler.

The JAAS Authentication process sets several cookies in the shopper's browser on successful authentication that identify the logged in state of the shopper and allow access to shopper specific information. This is set by AEM's own Authentication Handlers as well as Elastic Path's Cortex Authentication Handler.

ANONYMOUS users are identified by a Cortex token with role PUBLIC which is saved in a cortex session cookie. No entries are created in the JCR for PUBLIC users.