How do I activate an OAuth provider in i-Reserve?

i-Reserve supports logging in via external OAuth2 providers, for both customers (front office) and administrators (back office). This page describes how to configure and activate a provider in i-Reserve itself. To create the necessary details with the provider itself, see "Which providers can I use and what data do I need?".

Before you begin

• You need the OAuth providers right (menu_config_oauth2) to open the configuration page.
• You need the login details of the external provider (Client ID + Secret; for Microsoft and Apple, additional fields apply, see the table below).
• When registering the application with the provider, you must provide the correct redirect URLs, otherwise the provider will refuse the login. See "What is the redirect URL?". In short:
  • https://<yourdomain>/login — required for client login
  • https://<yourdomain>/adminlogin — required for administrator login

Step 1: Open the configuration page

Go to Configuration → System and click on the OAuth providers card.

You will now see an overview of the already configured providers, showing the status for the client login (active) and the administrator login (active (administration)) for each provider.

Step 2: Add a provider

Click on Add provider. In the dialog box, enter:

Tip: after choosing the provider, the dialog box shows a direct link to that provider's developer portal, where you register the application and create the data.

Provider parameters per provider

Note regarding Microsoft: the Tenant field is required. Enter the tenant ID (Directory ID) of your Microsoft Enterprise ID environment here. You can find this at portal.azure.com under app registration in Directory (tenant) ID. Only users from that tenant can then log in. If you have registered the app for multiple organizations (multi-tenant), enter common.

Different steps apply for Apple; see "How can I enable login with Apple ID?".

Step 3: Choose where the provider is active

The two switches active and active (administration) work independently of each other:

• If you want customers to be able to log in with, for example, their Google account, set active to yes.
• If you also want your own employees to log in to the administration section via the provider (single sign-on), set active (administration) to yes.
• You can therefore select a provider only for customers, only for administrators, or for both. activate.

Save the configuration. The change takes effect immediately.

Step 4: Check the operation

1. Open the login page (client: https://<yourdomain>/login, administration: https://<yourdomain>/adminlogin) in a private/incognito window.
2. The button for the activated provider is now visible below the regular login form.
3. Log in via the provider. The first time you log in, the provider will ask for permission to the bato share personal data (name, email address).

Common problems