Typically, you should only keep authentication for the main subdomains. User-generated subdomains should not use authentication, as Google Sites does. You can technically use Wildcard URL placeholders, but not in production, since they pose a security threat. Make the user-generated subdomains accessible without authentication.
If you have any other questions, feel free to reach out.
Have a good one,
Vlad