Social sign-in

You'll learn how to register redirect URIs, create a social provider connection in SqlOS, and test the hosted login flow.

Goal#

Users click provider buttons such as Continue with Google, Continue with Microsoft, or Continue with GitHub on the hosted AuthPage.

The screenshot shows a deliberately configured environment with GitHub and Microsoft enabled. The Todo demo does not seed GitHub, and its Microsoft connection appears only when client credentials are configured. Provider buttons appear only for enabled connections.

Google#

1. In Google Cloud Console, create an OAuth Web application client.
2. Open /sqlos/admin/auth/oidc in your running app.
3. Create a connection with provider Google, your client ID and secret.
4. Copy the exact callback URI SqlOS shows—normally /sqlos/auth/oidc/callback, with no connection-id suffix—and add it to Google’s authorized redirect URIs.
5. Confirm the connection is enabled; new connections start enabled.

See Google OIDC for curl-based setup and failure modes.

Microsoft#

1. Register an app in Microsoft Entra (App registrations).
2. Add a redirect URI matching SqlOS (same pattern as Google).
3. Create the connection in /sqlos/admin/auth/oidc with provider Microsoft.
4. Confirm the connection is enabled; new connections start enabled.

See Microsoft OIDC.

GitHub#

1. Create a GitHub OAuth App in GitHub Developer settings.
2. Open /sqlos/admin/auth/oidc in your running app.
3. Create a connection with provider GitHub, your GitHub OAuth App client ID, and client secret.
4. Copy the provider callback URI SqlOS shows and set it as the GitHub OAuth App Authorization callback URL.
5. Confirm the connection is enabled; new connections start enabled.

SqlOS requests read:user and user:email by default so it can load the GitHub profile and verified primary email address. See GitHub OIDC for dashboard, API, and code-first setup.

Seed from startup#

Instead of clicking through the dashboard, you can seed a connection from code so it exists on a fresh database. This is consistent with SeedAuthPage, SeedAuthEmails, and client seeding: the bootstrapper reconciles the connection on startup, matched by provider type (and display name for custom providers).

builder.AddSqlOS<AppDbContext>(options =>
{
    var auth = options.AuthServer;
 
    // "Continue with Microsoft". Keep secrets in configuration/user-secrets, never in source.
    auth.SeedMicrosoftConnection(
        clientId: builder.Configuration["SqlOS:Oidc:Microsoft:ClientId"]!,
        clientSecret: builder.Configuration["SqlOS:Oidc:Microsoft:ClientSecret"]!,
        tenant: "common",
        "https://your-app.example.com/sqlos/auth/oidc/callback");
 
    // "Continue with Google".
    auth.SeedGoogleConnection(
        clientId: builder.Configuration["SqlOS:Oidc:Google:ClientId"]!,
        clientSecret: builder.Configuration["SqlOS:Oidc:Google:ClientSecret"]!,
        "https://your-app.example.com/sqlos/auth/oidc/callback");
 
    // "Continue with GitHub". GitHub uses OAuth profile/email lookup through the same social provider surface.
    auth.SeedGitHubConnection(
        clientId: builder.Configuration["SqlOS:Oidc:GitHub:ClientId"]!,
        clientSecret: builder.Configuration["SqlOS:Oidc:GitHub:ClientSecret"]!,
        "https://your-app.example.com/sqlos/auth/oidc/callback");
});

For Apple or fully custom providers, use the general form:

auth.SeedOidcConnection("workforce", oidc =>
{
    oidc.ProviderType = SqlOSOidcProviderType.Custom;
    oidc.DisplayName = "Acme Identity";
    oidc.ClientId = builder.Configuration["SqlOS:Oidc:Acme:ClientId"]!;
    oidc.ClientSecret = builder.Configuration["SqlOS:Oidc:Acme:ClientSecret"];
    oidc.DiscoveryUrl = "https://id.acme.com/.well-known/openid-configuration";
    oidc.AllowedCallbackUris = ["https://your-app.example.com/sqlos/auth/oidc/callback"];
});

Test#

1. Start your app's OAuth login flow at /sqlos/auth/authorize (normally through your framework's OAuth middleware).
2. Enter an email and choose the social provider.
3. Complete the IdP flow and confirm you land back in your app with a valid session.

Next steps#

• SAML SSO for an org
• OIDC overview
• GitHub provider reference
• Troubleshooting