Documentation:External login services in MDriven Turnkey

External login services in MDriven Turnkey

This page was created by Denis on 2018-03-02. Last edited by Wikiadmin on 2026-07-29.

You can enable Google, Microsoft, and Facebook sign-in for a MDriven Turnkey site by registering your site with the provider and sending the provider credentials to Turnkey; this page is for Turnkey administrators.

External login lets a user authenticate with an account at a third-party identity provider instead of a password created in your site. Turnkey creates and maintains the local user connection through the SysUserAuthentication pattern, including a SysExternalLogin object for the external provider.

For a video walkthrough of Google, Facebook, and Microsoft setup, see MDriven Turnkey Part 6: Social Login.

Before you begin

Confirm that your model includes the SysUserAuthentication pattern. The pattern provides Turnkey registration, sign-in, and external-login handling.
Identify the public base URL of the Turnkey site. For example: https://mdriventestone.azurewebsites.net.
Decide which providers you will offer. Configure each provider separately.
Sign in to portal.mdriven.net with the account that owns the Turnkey site.
Open the site in the MDriven Portal: select Views and then Show my Turnkey sites.

Each provider requires a redirect URI. A redirect URI is the URL to which the provider returns the browser after the user has authenticated. The URI registered with the provider must match your Turnkey site and the provider-specific ending exactly.

Provider	Required redirect URI	Example for `https://mdriventestone.azurewebsites.net`
Google	`<site-url>/signin-google`	`https://mdriventestone.azurewebsites.net/signin-google`
Microsoft	`<site-url>/signin-microsoft`	`https://mdriventestone.azurewebsites.net/signin-microsoft`
Facebook	`<site-url>/signin-facebook`	`https://mdriventestone.azurewebsites.net/signin-facebook`

Configure Google sign-in

Go to Google Developers Console and sign in with the Google account that will own the integration.
Open Credentials, select Create Credential, and choose OAuth Client ID.
Choose Web application.
Enter the application name and the site URL requested by Google.
Add the authorized redirect URI <site-url>/signin-google. For example, enter https://mdriventestone.azurewebsites.net/signin-google.
Turn on the Google+ API.
Create the credential, then copy its Client ID and Client Secret.
Return to the selected Turnkey site in the MDriven Portal. Paste the values into Google Client ID and Google Client Secret.
Save the portal changes, then select Send Settings and Restart.

After the restart, open the site's login page. Google should be available as an external sign-in option.

Configure Microsoft sign-in

Go to App registrations in the Azure portal and sign in with the Microsoft account that will own the integration.
Select New Registration.
Enter an application name. Microsoft shows this name to users during sign-in.
Select the account types that may use the application login.
Choose Web and add the redirect URI <site-url>/signin-microsoft. For example, enter https://mdriventestone.azurewebsites.net/signin-microsoft.
Select Register.
In the left menu, select Certificates and secrets.
Under Client secrets, select + New client secret.
Enter a description and expiration time, then select Add.
Copy the secret Value now. Microsoft displays this value only once.
Copy the application's Application ID.
Return to the selected Turnkey site in the MDriven Portal. Paste the Application ID into Microsoft Client ID and the secret value into Microsoft Client Secret.
Save the portal changes, then select Send Settings and Restart.

You can also use Branding and properties in the Azure portal to provide a logo and application information, including the site's home-page URL. To review an account's granted application rights, use Microsoft consent.

Configure Facebook sign-in

Go to Facebook for Developers and sign in or create a developer account.
Open My apps and select Add a new App.
Name the app. On the next screen, select Set up on the Facebook Login card.
Select the Web platform and enter the site URL, then save and continue. You can skip the remaining setup steps at this point.
Open Settings → Basic. Enter the application URL as the App domain and save the changes.
Open the Client OAuth settings and add <site-url>/signin-facebook as a valid OAuth Redirect URI. For example, enter https://mdriventestone.azurewebsites.net/signin-facebook.
Copy the Facebook App ID and App Secret.
Return to the selected Turnkey site in the MDriven Portal. Paste the values into Facebook Client ID and Facebook Client Secret.
Save the portal changes, then select Send Settings and Restart.

Test the sign-in flow

Wait for the Turnkey restart to complete, then open the site in a new browser session.
Go to the login page and select the button for the provider you configured.
Authenticate with a provider account and approve the requested access.
Complete the first-sign-in registration in Turnkey when prompted.

Turnkey uses a local user identity as part of the external-login flow. In the walkthrough, the email used for the local account must be unique in the application. If you test several providers, use an email identity that does not conflict with an existing local user.

If the provider button does not appear, verify that you entered both the client ID and client secret in the correct portal fields and that you selected Send Settings and Restart after saving. If a restart reports an error because the application is busy, retry the restart.

Control the login interface

Turnkey can display external-login buttons in the default navigation and login UI. If you use a custom login page, you can hide the default navigation buttons with Hide External Login Buttons.

For a site that must use external sign-in rather than local passwords, configure Hide Password login. Related Turnkey settings also control whether a user can edit the email proposed during first external sign-in and whether Turnkey shows the external-account confirmation screen.

Troubleshoot a user stuck on Register

A user who authenticates successfully with a provider but remains stuck on the Register page can have stale or incorrect SysUser or SysExternalLogin data. Follow External login screen problem to remove the old objects, clear the running server state as instructed, and—when applicable—remove the application's approval from the user's provider account before testing again.

Windows Authentication for intranet sites

Windows Authentication is different from Google, Microsoft, and Facebook external sign-in. Use it when an intranet Turnkey site should use existing Kerberos Windows authentication. Configure IIS to perform authentication before the application, following the MDrivenServer IIS authentication guidance, and make the required Turnkey web.config changes for SingleSignOn.

Contents