Proper way to handle user accounts with CloudKit

I've been away from iOS development for 5 years. I'm back and creating an app that uses CloudKit and I want my users to log in to the application. Ideally they will just need a username and password. If the password is forgotten they'll need a way to reset it so I'll have to store their email as well.

My question is What is the best practice for user account information, i.e. username, email, and password.

Is it as simple as storing the username publicly, then the email and password privately on the CloudKit user?
Proper way to handle user accounts with CloudKit
 
 
Q