GeoHazardWatch can let you sign in with an account you already have somewhere else, such as Google, Apple, Microsoft, or your organization's own sign-in, if your site offers them. Instead of typing a password here, you click that provider's button on the sign-in page, sign in there, and come back already signed in. These buttons are under External provider on the sign-in page, each with the provider's icon beside its name.
This is only available if your site's administrator has turned it on. If the sign-in page has no External provider section, your site does not offer it.
An outside account signs you in here only once it is connected to your account on this site. To connect one:
The connected account then appears under Sign-in methods as an outside sign-in, with its email address, when it was connected, and when it was last used.
An outside account can be connected to only one account on this site. If it is already connected to someone else's account here, connecting it is refused.
Once connected, click the provider's button under External provider on the sign-in page. After you sign in there, you are signed in here as your own account.
If your administrator later turns that provider off, the connection stays on your profile but cannot sign you in until it is turned back on. Your profile says so next to it.
If you click the button for a provider whose account is not connected to anything here, you are not signed in. The sign-in page asks you to sign in to connect that account instead:
You can also click Don't connect it on the sign-in page to cancel straight away. The offer only waits a few minutes, and signing out cancels it. If it runs out, nothing is connected; you can connect it from your profile at any time.
Your email address is never used to sign you in. Even if the outside account has the same email as your account here, you still sign in your usual way and confirm the connection once.
To stop an outside account signing you in, open your Profile, find it under Sign-in methods and click Disconnect.
You must always keep at least one other way to sign in, such as a password or a passkey. If the outside account is your only way in, add another one first; disconnecting the last one is refused.
Some sites let you create a new account here just by signing in with an outside account. This only happens when the site allows sign-up this way, and only when the provider has verified your email address. The new account gets the same starting access as anyone who signs up, and the outside account is connected to it.
If your email address already belongs to an account here, no new account is made. Sign in to that account your usual way and connect the outside account when asked, or from your profile.
If the site does not allow sign-up this way, ask your administrator for an account, then connect the outside account to it.
An outside account only proves who you are. It never gives you roles or permissions on this site, whatever groups or roles you have at the provider. What you can see and do here is decided by your administrator. See User Roles and Permissions.
Your administrator can also limit which sign-in methods your account may use. If a provider is not offered under Connect on your profile, it may not be allowed for your account.
A connected outside account does not change your password here, and changing your password at the provider does not change anything here. See Password Management Guide.
Outside sign-in uses OpenID Connect, so it works with Google and with any provider that supports it, including a self-hosted one.
ngdpbase.auth.oidc.providers in Admin Configuration or in app-custom-config.json. Each entry has a short name (lowercase letters, digits and hyphens), and either a preset such as google or the provider's issuer, plus client-id, client-secret, enabled: true, and optionally display-name for the button text and icon for the picture beside it.icon is either the address of an image, starting https:// or a path on this site starting with /, or a Font Awesome icon name such as fa-users or fab fa-microsoft. Anything else is ignored and the default icon shown. Without it, Google shows its logo, Microsoft and Apple their own icons, and any other provider a general sign-in icon.client-secret must name an environment variable, written as $NAME (for example $GOOGLE_CLIENT_SECRET), with the secret itself in your .env. An entry with the secret written into the configuration is not used.preset: apple. Instead of client-secret, Apple needs team-id, key-id and private-key, where private-key names an environment variable holding the key file Apple gives you. Apple only works on a site with an https address.<your site address>/auth/oauth/<name>/callback with the provider, where <name> is the entry's name. Your site address (ngdpbase.application.base-url) must be set explicitly, or the provider is not offered.ngdpbase.auth.oidc.auto-provision, the entry's own auto-provision, and ngdpbase.application.registration all set to true.ngdpbase.security.egress.allowed-ranges.ngdpbase.auth.google-oidc.* settings still work as the google entry, but their automatic account creation, default roles and domain restriction are no longer used. Prefer ngdpbase.auth.oidc.providers for a new setup.Changes to the list of providers take effect when the server restarts. If a provider does not appear on the sign-in page after a restart, the server log says why it was not turned on.