You can recover an external-login user who is repeatedly sent to the Register page by removing stale authentication records so that Turnkey's SysUserAuthentication pattern can recreate them on the user's next provider sign-in.
Symptoms and likely cause
This procedure applies when a user signs in through an external identity provider, such as Google, Microsoft, or Facebook, but is sent to the Register page instead of completing sign-in.
A likely cause is that old or incorrect authentication objects remain for that user:
| Object | Purpose | Why it can cause this problem |
|---|---|---|
SysUser
|
Stores the application's user account. | A stale user account can conflict with the account that Turnkey needs to create or associate during external sign-in. |
SysExternalLogin
|
Stores the association between a SysUser and a third-party login, for example Google, Microsoft, or Facebook.
|
An incorrect or stale association can prevent Turnkey from resolving the external identity to the expected local user. |
Recover the affected external login
Before changing authentication objects, make sure you are working with the records for the affected user and external login. Removing these records removes the existing local association; the user will need to authenticate with the external provider again.
- Ask the user to log out of the application and close all browser windows. This prevents an existing browser session from continuing to use stale authentication state.
- Remove the previous
SysUserandSysExternalLoginobjects for the affected login. Prefer removing them from within your application, so that the removal is synchronized with objects held in server memory. - If you must remove the objects directly in the database, restart the Turnkey server after the change. If you cannot restart it, wait at least 15 minutes for the objects to be removed from running EcoSpaces.
- If the user signs in with Google, ask them to remove your application's approval in their Google account before they try again. This clears the provider-side approval for the application.
- Have the user start a new browser session and sign in again using the external login provider.
- Confirm that Turnkey recreates the required
SysUserandSysExternalLoginobjects and that the user reaches the application instead of returning to the Register page.
Expected result
On the next successful authentication with the social login service, Turnkey recreates the local SysUser and SysExternalLogin objects. The recreated external-login association is then used for later sign-ins.
For example, if a user is stuck after selecting Google sign-in, remove the affected user's old local authentication objects, restart the Turnkey server if the records were deleted directly from the database, and have the user remove the application's Google approval. When the user signs in with Google again, Turnkey creates a new local user and external-login association.
If the problem continues
This recovery procedure addresses stale local authentication objects. If the external provider cannot complete authentication at all, verify the provider configuration separately, including its configured redirect URL and the credentials sent to the Turnkey site. See Documentation:External login services in MDriven Turnkey.
Do not use this procedure to change which login choices are displayed. To hide the standard external-login buttons when you provide your own login page, see HowTos:Hide External Login Buttons. To require external login instead of password registration, see Documentation:Hide Password login.