Sign-in providers

Available

Deployed and supported. The fields and commands described here are stable within version v1alpha1.

Your applications' users have no password: they sign in with one of the methods you enable. Each method is a sign-in provider, declared by an IAMProvider manifest or created from the console (Authentication → Providers).

Type	Sign-in	Credentials to provide
Email	single-use link sent to the person's address	none
Google	Google account	client-id, client-secret
GitHub	GitHub account	client-id, client-secret
GitLab	gitlab.com, or your instance (baseURL)	client-id, client-secret
Microsoft	Microsoft account (azureTenant: common, organizations, consumers or a directory identifier)	client-id, client-secret
LinkedIn	LinkedIn account	client-id, client-secret
OIDC	any OpenID Connect provider (issuer)	client-id, client-secret

Prerequisites

• A session on the tenant: sng tenant use acme.
• deploy:write (policy readwrite or admin).
• For an external provider: an application declared with that provider, whose return address is the one it asks you for (shown in the console when you create the provider), and its credentials.

Steps

Link sent by email

The simplest: no secret, no sign-up with a third party.

email.yml

apiVersion: iam.stackngo.io/v1alpha1
kind: IAMProvider
metadata:
  name: email
spec:
  category: OAuth
  type: Email
  displayName: Receive a link by email   # optional, 40 characters

sng apply email.yml

The user enters their address, receives a link valid only once and must open it in the same browser as the one where they requested it. The response is identical whether or not the address has an account, and the number of requests is limited per address and per device.

An external provider (Google, GitHub…)

1. Store the credentials in a secret of the tenant, with the keys client-id and client-secret.
2. Declare the provider, citing that secret:

google.yml

apiVersion: iam.stackngo.io/v1alpha1
kind: IAMProvider
metadata:
  name: google
spec:
  category: OAuth
  type: Google
  credentialsSecretRef:
    name: google-oauth        # secret with client-id and client-secret

sng apply google.yml

For an OIDC provider, add issuer (HTTPS) and displayName (button label, required); for self-hosted GitLab, baseURL; for Microsoft, azureTenant. These fields are only accepted for their type. scopes adds scopes to openid, profile and email.

OIDC example:

sso-acme.yml

apiVersion: iam.stackngo.io/v1alpha1
kind: IAMProvider
metadata:
  name: sso-acme
spec:
  category: OAuth
  type: OIDC
  displayName: SSO Acme
  issuer: https://login.acme.example
  credentialsSecretRef:
    name: acme-sso-oauth

Account linking

When a person signs in, StackNGO finds their account by email address only if the provider guarantees the address is verified (Google, Microsoft, GitHub with a verified primary address, email link). A self-hosted GitLab instance never merges accounts by email. A person can then add other methods to their account, including a passkey.

Verification

sng iam provider list
sng iam provider describe google

Providers appear with their type and Ready. The sign-in page shows one button per ready provider (Sign-in page).

Limits

• No password or SAML: only the OAuth category is accepted.
• deletionPolicy: Block (default) delays deleting a provider that is still in use, then carries it out.
• Credential secrets are never read back by sng iam provider describe.

See also

• IAMProvider
• Users of your applications
• sng iam provider