SSO (Google / Microsoft)

Federated sign-in lets users authenticate with their Google or Microsoft account instead of a local password.

Current status

Google and Microsoft sign-in buttons are shown on the login page when the operator has configured the relevant environment variables:

Provider	Variable	Effect when empty
Google	GOOGLE_CLIENT_ID	Google button hidden
Microsoft	MICROSOFT_CLIENT_ID	Microsoft button hidden

Full per-tenant client credentials and authorization-code wiring in AuthServer are tracked in the product backlog (tier-gaps.md in the repository root).

Configure Google sign-in (operator)

1. Create an OAuth 2.0 client ID in the Google Cloud Console.
2. Add your AuthServer URL as an authorised redirect URI.
3. Set GOOGLE_CLIENT_ID in the .env file and restart the AuthServer.

Configure Microsoft sign-in (operator)

1. Register an application in Microsoft Entra.
2. Add your AuthServer URL as a redirect URI.
3. Set MICROSOFT_CLIENT_ID and optionally MICROSOFT_AUTHORITY in .env and restart.

Related

• Integrations
• First sign-in and MFA