Sign-in methods

There are three ways to sign in, and all of them are on every edition. Staff domains apply to both external methods.

Email and password #

Always on. Users join by invite, and password resets work by email. See email.

Google #

Set AUTH_GOOGLE_ID and AUTH_GOOGLE_SECRET with eddy config. In Google’s console, register this callback URL:

https://<your domain>/api/auth/callback/google

OpenID Connect #

Works with any provider that supports OpenID Connect, such as Microsoft Entra ID or Okta. Set these with eddy config:

• AUTH_OIDC_ISSUER, AUTH_OIDC_ID and AUTH_OIDC_SECRET
• AUTH_OIDC_NAME, optional, sets the button label, for example “Sign in with Microsoft”. The default is “Single sign-on”.

One provider per install. It uses the authorization code flow with PKCE, state and nonce. Register this callback URL with the provider:

https://<your domain>/api/auth/callback/oidc

For Microsoft, use a tenant issuer such as https://login.microsoftonline.com/<tenant id>/v2.0. The shared endpoints /common/, /organizations/ and /consumers/ are refused, because any Microsoft account could then present any email address.

Which email is trusted #

The email comes from the ID token’s email claim, and it is trusted only when email_verified is true. A missing claim counts as unverified.

Microsoft Entra ID often leaves the claim out. For a single-tenant Entra ID or an Okta org, where your own admins own every account, you can set AUTH_OIDC_TRUST_EMAIL=true. Do not set it for a provider where anyone can create an account.

An unverified email is refused outright. It never matches an existing account, an invite or a staff domain. The login page says “Your sign-in provider did not confirm your email address. Ask your admin.”

Who gets in #

The same rules apply to Google and OpenID Connect:

• An existing active user signs in. A deactivated user is refused.
• An email on a staff domain creates a staff user, if the licence has room for another team member.
• An email with a pending invite creates that user.
• Anyone else sees “This account has not been invited.”

Accounts match by email, so one person can use a password, Google and OpenID Connect on the same account.

When something is wrong #

A missing value or a refused issuer leaves the provider off, writes one warning to the log without the secret, and shows the problem in the Sign-in section of /admin/settings. Password sign-in keeps working. If the provider is down at sign-in time, users see “Single sign-on is not working right now. Sign in with your password or ask your admin.”