Social sign-in

You'll learn how to register redirect URIs, create a social provider connection in SqlOS, and test the hosted login flow.

Goal#

Users click provider buttons such as Continue with Google, Continue with Microsoft, or Continue with GitHub on the hosted AuthPage.

Google#

1. In Google Cloud Console, create an OAuth Web application client.
2. Open /sqlos/admin/auth/oidc in your running app.
3. Create a connection with provider Google, your client ID and secret.
4. Copy the callback URI SqlOS shows (includes your connection id) and add it to Google’s authorized redirect URIs.
5. Enable the connection in the dashboard.

See Google OIDC for curl-based setup and failure modes.

Microsoft#

1. Register an app in Microsoft Entra (App registrations).
2. Add a redirect URI matching SqlOS (same pattern as Google).
3. Create the connection in /sqlos/admin/auth/oidc with provider Microsoft.
4. Enable the connection.

See Microsoft OIDC.

GitHub#

1. Create a GitHub OAuth App in GitHub Developer settings.
2. Open /sqlos/admin/auth/oidc in your running app.
3. Create a connection with provider GitHub, your GitHub OAuth App client ID, and client secret.
4. Copy the provider callback URI SqlOS shows and set it as the GitHub OAuth App Authorization callback URL.
5. Enable the connection.

SqlOS requests read:user and user:email by default so it can load the GitHub profile and verified primary email address. See GitHub OIDC for dashboard, API, and code-first setup.

Seed from startup#

Instead of clicking through the dashboard, you can seed a connection from code so it exists on a fresh database. This is consistent with SeedAuthPage, SeedAuthEmails, and client seeding: the bootstrapper reconciles the connection on startup, matched by provider type (and display name for custom providers).

builder.AddSqlOS<AppDbContext>(options =>
{
    var auth = options.AuthServer;
 
    // "Continue with Microsoft". Keep secrets in configuration/user-secrets, never in source.
    auth.SeedMicrosoftConnection(
        clientId: builder.Configuration["SqlOS:Oidc:Microsoft:ClientId"]!,
        clientSecret: builder.Configuration["SqlOS:Oidc:Microsoft:ClientSecret"]!,
        tenant: "common",
        "https://your-app.example.com/sqlos/auth/oidc/callback");
 
    // "Continue with Google".
    auth.SeedGoogleConnection(
        clientId: builder.Configuration["SqlOS:Oidc:Google:ClientId"]!,
        clientSecret: builder.Configuration["SqlOS:Oidc:Google:ClientSecret"]!,
        "https://your-app.example.com/sqlos/auth/oidc/callback");
 
    // "Continue with GitHub". GitHub uses OAuth profile/email lookup through the same social provider surface.
    auth.SeedGitHubConnection(
        clientId: builder.Configuration["SqlOS:Oidc:GitHub:ClientId"]!,
        clientSecret: builder.Configuration["SqlOS:Oidc:GitHub:ClientSecret"]!,
        "https://your-app.example.com/sqlos/auth/oidc/callback");
});

For Apple or fully custom providers, use the general form:

auth.SeedOidcConnection(oidc =>
{
    oidc.ProviderType = SqlOSOidcProviderType.Custom;
    oidc.DisplayName = "Acme Identity";
    oidc.ClientId = builder.Configuration["SqlOS:Oidc:Acme:ClientId"]!;
    oidc.ClientSecret = builder.Configuration["SqlOS:Oidc:Acme:ClientSecret"];
    oidc.DiscoveryUrl = "https://id.acme.com/.well-known/openid-configuration";
    oidc.AllowedCallbackUris = ["https://your-app.example.com/sqlos/auth/oidc/callback"];
});

Test#

1. Open your app’s login entry point (or /sqlos/auth/login).
2. Enter an email and choose the social provider.
3. Complete the IdP flow and confirm you land back in your app with a valid session.

Next steps#

• SAML SSO for an org
• OIDC overview
• GitHub provider reference
• Troubleshooting