Signing In With Another Account

GeoHazardWatch can let you sign in with an account you already have somewhere else, such as Google, Apple, Microsoft, or your organization's own sign-in, if your site offers them. Instead of typing a password here, you click that provider's button on the sign-in page, sign in there, and come back already signed in. These buttons are under External provider on the sign-in page, each with the provider's icon beside its name.

This is only available if your site's administrator has turned it on. If the sign-in page has no External provider section, your site does not offer it.

Connecting an Account

An outside account signs you in here only once it is connected to your account on this site. To connect one:

1 Sign in the way you usually do.
2 Open your Profile and find Sign-in methods.
3 Click Connect next to the provider you want, for example Connect Google.
4 You may be asked to confirm it is you by signing in again. Connecting a new way into your account is a security change, so the site checks first.
5 Sign in at the provider and allow it. You come back to your profile, which says whether it worked.

The connected account then appears under Sign-in methods as an outside sign-in, with its email address, when it was connected, and when it was last used.

An outside account can be connected to only one account on this site. If it is already connected to someone else's account here, connecting it is refused.

Signing In With It

Once connected, click the provider's button under External provider on the sign-in page. After you sign in there, you are signed in here as your own account.

If your administrator later turns that provider off, the connection stays on your profile but cannot sign you in until it is turned back on. Your profile says so next to it.

If It Is Not Connected Yet

If you click the button for a provider whose account is not connected to anything here, you are not signed in. The sign-in page asks you to sign in to connect that account instead:

1 Sign in your usual way, for example with your password.
2 You are asked Connect an account?, showing the outside account and your account here.
3 Choose Connect only if that outside account is yours. Anyone who can sign in to it will be able to sign in here as you.
4 Choose Don't connect if you are not sure, or if you are on a shared or public computer: the outside account may belong to whoever used the browser before you.

You can also click Don't connect it on the sign-in page to cancel straight away. The offer only waits a few minutes, and signing out cancels it. If it runs out, nothing is connected; you can connect it from your profile at any time.

Your email address is never used to sign you in. Even if the outside account has the same email as your account here, you still sign in your usual way and confirm the connection once.

Disconnecting an Account

To stop an outside account signing you in, open your Profile, find it under Sign-in methods and click Disconnect.

You must always keep at least one other way to sign in, such as a password or a passkey. If the outside account is your only way in, add another one first; disconnecting the last one is refused.

New Accounts

Some sites let you create a new account here just by signing in with an outside account. This only happens when the site allows sign-up this way, and only when the provider has verified your email address. The new account gets the same starting access as anyone who signs up, and the outside account is connected to it.

If your email address already belongs to an account here, no new account is made. Sign in to that account your usual way and connect the outside account when asked, or from your profile.

If the site does not allow sign-up this way, ask your administrator for an account, then connect the outside account to it.

Roles and Permissions

An outside account only proves who you are. It never gives you roles or permissions on this site, whatever groups or roles you have at the provider. What you can see and do here is decided by your administrator. See User Roles and Permissions.

Your administrator can also limit which sign-in methods your account may use. If a provider is not offered under Connect on your profile, it may not be allowed for your account.

Passwords

A connected outside account does not change your password here, and changing your password at the provider does not change anything here. See Password Management Guide.

For Administrators

Outside sign-in uses OpenID Connect, so it works with Google and with any provider that supports it, including a self-hosted one.

Where it is set: ngdpbase.auth.oidc.providers in Admin Configuration or in app-custom-config.json. Each entry has a short name (lowercase letters, digits and hyphens), and either a preset such as google or the provider's issuer, plus client-id, client-secret, enabled: true, and optionally display-name for the button text and icon for the picture beside it.
Button icon: icon is either the address of an image, starting https:// or a path on this site starting with /, or a Font Awesome icon name such as fa-users or fab fa-microsoft. Anything else is ignored and the default icon shown. Without it, Google shows its logo, Microsoft and Apple their own icons, and any other provider a general sign-in icon.
Client secret: client-secret must name an environment variable, written as $NAME (for example $GOOGLE_CLIENT_SECRET), with the secret itself in your .env. An entry with the secret written into the configuration is not used.
Apple: use preset: apple. Instead of client-secret, Apple needs team-id, key-id and private-key, where private-key names an environment variable holding the key file Apple gives you. Apple only works on a site with an https address.
Callback address: register <your site address>/auth/oauth/<name>/callback with the provider, where <name> is the entry's name. Your site address (ngdpbase.application.base-url) must be set explicitly, or the provider is not offered.
Creating accounts: off by default. It needs ngdpbase.auth.oidc.auto-provision, the entry's own auto-provision, and ngdpbase.application.registration all set to true.
A provider on your own network: the site only contacts it if its addresses are allowed in ngdpbase.security.egress.allowed-ranges.
Older Google settings: the ngdpbase.auth.google-oidc.* settings still work as the google entry, but their automatic account creation, default roles and domain restriction are no longer used. Prefer ngdpbase.auth.oidc.providers for a new setup.

Changes to the list of providers take effect when the server restarts. If a provider does not appear on the sign-in page after a restart, the server log says why it was not turned on.