What is OAuth2 SSO?
OAuth 2.0 (Open Authorization) is a technical standard that lets you authorize user access to your community. You can use OAuth2 SSO to let users access your community with their existing credentials from another website or application. Bettermode supports the most common OAuth2 implementations, including OpenID Connect, for both authentication and authorization.
How OAuth2 SSO works
When you enable OAuth2 SSO, Bettermode redirects users to your identity provider. Here's what happens next:
If the user isn't already logged in, they see the login screen for your identity provider.
After logging in, your identity provider generates an access token.
Bettermode receives this token and fetches the user's information.
Bettermode either creates a new user account or updates an existing one and logs them in.
New user vs. existing user
New user: Bettermode creates a user account using the information from your identity provider and logs them in immediately.
Existing user: Bettermode updates the user's information and logs them in.
How Bettermode identifies existing users
Bettermode uses the following process to determine if a user already has an account:
Checks if a user exists with the same external ID from your identity provider.
If no match is found, searches for a user with the same email address.
If a user is found by email, Bettermode connects their external ID to the one provided by your identity provider.
Resolving login conflicts
A conflict occurs when an existing user has the same email address but a different external ID. To resolve this conflict, refer to How to resolve a login conflict.
Supported OAuth2 methods
Bettermode supports the following OAuth2 identity providers. Click on any option below for step-by-step setup instructions and required credentials:
Disable email and password login
To direct members to your SSO provider when they visit your community, disable the email and password login option:
Click your profile picture in the top-right corner.
Go to Administration > Settings > Authentication.
Toggle off Login & register with email.
Once disabled, users will not see the default email and password login option.
