You can enable Google, Facebook, and Microsoft sign-in for an MDriven Turnkey site by registering each provider application and sending its client credentials to your Turnkey site; this guide is for Turnkey site administrators.
External login lets a user authenticate with an account from an external identity provider instead of creating and using a separate password for the site. Turnkey creates or connects the user's local account during the first external sign-in.
Before you begin
You need:
- Access to the Turnkey site in portal.mdriven.net.
- The public HTTPS URL of the Turnkey application. For example:
https://mdriventestone.azurewebsites.net/. - Administrative access to each identity provider you plan to enable.
- A separate client ID and client secret for each provider. Keep client secrets private.
Decide which providers to offer before registering applications. You can configure one, two, or all three providers independently.
Configure an external login provider
- Sign in to portal.mdriven.net.
- Open the target application through Views → Show my Turnkey sites.
- Register an OAuth web application with the chosen provider. OAuth is the authorization flow that returns the user to your site after the provider has authenticated them.
- Give the provider the site URL and the provider-specific redirect URI listed below.
- Copy the provider's client ID and client secret into the matching fields for the Turnkey site in the MDriven Portal.
- Save the portal changes, then select Send Settings and Restart. The provider button does not become available until the settings have been sent and the application has restarted.
- Open the Turnkey site, sign out if necessary, and check that the configured provider is available on the login screen.
| Provider | Redirect URI to register | Credentials to copy to the MDriven Portal |
|---|---|---|
<site URL>/signin-googleExample: https://mdriventestone.azurewebsites.net/signin-google
|
Google Client ID and Google Client Secret | |
<site URL>/signin-facebookExample: https://mdriventestone.azurewebsites.net/signin-facebook
|
Facebook Client ID (App ID) and Facebook Client Secret (App Secret) | |
| Microsoft | <site URL>/signin-microsoftExample: https://mdriventestone.azurewebsites.net/signin-microsoft
|
Microsoft Client ID (Application ID) and Microsoft Client Secret |
The redirect URI must be the full application URL followed by the exact suffix for that provider. For example, registering https://mdriventestone.azurewebsites.net/ without /signin-microsoft does not register the Microsoft return address that Turnkey uses.
Provider registration details
Use the following provider-specific instructions when you create the external application. For complete field-by-field instructions, see Documentation:External login services in MDriven Turnkey.
- Go to Google Developers Console.
- Create an OAuth Client ID credential for a Web application.
- Enter the application name, home page URL, and the Google redirect URI ending in
/signin-google. - Turn on the Google+ API.
- Create the credential and copy its client ID and client secret to the Google fields in the MDriven Portal.
- Go to Facebook for Developers and create an app from My apps → Add a new App.
- Set up the Facebook Login product and select the Web platform.
- Enter the application URL as the Site URL.
- In Settings → Basic, enter the application URL as the App domain.
- In the Facebook Login client OAuth settings, add
<site URL>/signin-facebookas a valid OAuth redirect URI. - Copy the App ID and App Secret to the Facebook fields in the MDriven Portal.
Microsoft
- Go to App registrations in the Azure portal and select New Registration.
- Name the application and choose the account types that may use the login. The name is shown to users during Microsoft sign-in.
- Add a Web redirect URI ending in
/signin-microsoft. - Select Register.
- Open Certificates and secrets, select Client secrets, and select + New client secret. Choose a description and expiration, then select Add.
- Copy the secret Value when it is shown. Microsoft displays this value only once.
- Copy the application's Application ID and the secret value to the Microsoft fields in the MDriven Portal.
You can use Branding and properties in the Microsoft application registration to add a logo and application information, including its home page URL.
Test the first sign-in
- Open the Turnkey application in a browser and go to the login screen.
- Select one configured provider, such as Google.
- Complete the provider's consent and sign-in flow.
- When Turnkey asks you to register or confirm the local account, provide the required unique email address if the screen permits editing it.
- Complete the registration and confirm that you are signed in.
- Sign out and repeat the test for each enabled provider.
A user's external identity is associated with Turnkey's local user data. For the underlying authentication model, see Documentation:SysUserAuthentication.
Control the login experience
After external login works, choose the sign-in experience that fits the site.
| Requirement | Setting or guidance |
|---|---|
| Use a custom login page and remove the default external-login buttons | Configure HideExternalLogin. See HowTos:Hide External Login Buttons.
|
| Require users to sign in through external providers rather than local passwords | Configure HidePasswordLogin. See Documentation:Hide Password login.
|
| Control whether a user can change the email during their first social-login registration | Configure AllowUserToChooseSocialLoginEmail. See HowTos:Hide External Login Buttons.
|
| Skip the first external-account confirmation screen | Configure SkipExternalAccountConfirmationScreen. See HowTos:Hide External Login Buttons.
|
Troubleshooting
If the provider button is missing, confirm that both the client ID and client secret were saved in the MDriven Portal, then select Send Settings and Restart again. Also verify that the redirect URI registered with the provider has the exact provider suffix shown in the table.
If a user completes provider sign-in but becomes stuck on Turnkey's Register page, old or incorrect SysUser or SysExternalLogin objects may remain in the database. Have the user sign out and close their browser, remove the previous user and external-login objects through the application where possible, and restart the Turnkey server if removal was made directly in the database. For Google, also remove the application's approval from the user's Google account before testing again. Follow the full recovery procedure in Documentation:External login screen problem.