When someone tries to authenticate itself with an user identifier / “user name” and a password, the following process is executed:

1. If meta key owner of the configuration zettel does not have a valid zettel identifier as value, authentication fails.
2. Retrieve all zettel, where the meta key user-id has the same value as the given user identification. If the list is empty, authentication fails.
3. From above list, the zettel with the numerically smallest identifier is selected. Or in other words: the oldest zettel is selected¹.
4. If the zettel does not have a value for the meta key credential, authentication fails.
5. The value of the meta key credential is compared with the given password. If they do not match, authentication fails.

The authentication is successful, because the Zettelstore has an owner, the identifier matches an user zettel, and the password conforms to the stored credential.

1. This is done to prevent an attacker from creating a new note with the same user identification ↩︎