Signing in with another service's account as mishka_installer plugins on "auth:providers", the way MishkaCmsCore.Captcha.Provider makes captchas. The core names no provider: each ships as its own package (mishka_cms_auth_google, mishka_cms_auth_github, …) whose application starts its plugin, so a host that adds the dependency has the provider on every site's Security tab.

AshAuthentication does the sign-in itself, through one strategy for every provider (MishkaCmsCore.Accounts.ProviderStrategy: /api/auth/user/provider/<id>/request, and one callback for all, /api/auth/user/provider/callback). A plugin says which Assent strategy speaks to its provider (oauth/0) — Assent knows each provider's addresses and how its answer reads — and adds what differs per site: its keys, whether the site offers it, and its button. Every account a provider signs in keeps one MishkaCmsCore.Accounts.UserIdentity for it, named "provider/<id>".

A site that has not switched the provider on, has no keys for it, or whose provider plugin is stopped refuses it before the visitor is sent anywhere.

Settings

The Security tab's "Sign-in methods" table: each provider switched on per site (auth.providers.<id>.enabled) with its keys in its row, and auth.social.register, whether a first sign-in makes an account. A master signs in on the master site's address with the master site's providers. The address each provider sends the visitor back to is callback_url/1, which its console has to list.

use MishkaCmsCore.Accounts.SignInProvider,
  id: "github", label: gettext_noop("GitHub"), priority: 20

@impl true
def oauth, do: %{assent: Assent.Strategy.Github}