Single Sign-On Under Your Own Name

Google and Microsoft sign-in work out of the box through an application Pental registers, and the only place that shows is the consent screen: the first time somebody signs in, the browser asks whether they want to give Pental access to their account. Everything else they touch is yours. Registering your own application closes that last gap, and it takes about ten minutes per provider.

You need BOTH the client ID and the client secret for a provider before anything changes. With one of the two stored, that provider carries on using the shared application, because half a credential produces an error on the provider's own screen with nothing to say why.

The redirect URI, first

Both providers refuse to sign anybody in unless the address they send the browser back to is registered against the application in advance, character for character. Yours is your portal address with /api/sso on the end:

• Your own domain, if you have connected one: https://portal.yourfirm.com/api/sso
• Otherwise your Pental subdomain: https://yourfirm.pental.io/api/sso

The settings screen prints the exact value for your portal, so copy it from there rather than typing it. No trailing slash, https rather than http, and the hostname people actually sign in on. If you connect a custom domain later, add the new URI to the application before you switch, and keep the old one until nobody is using it.

Google

• In the Google Cloud console, pick or create a project for this.
• Open APIs and Services, then OAuth consent screen. Choose External, and set the application name and the support email. THE APPLICATION NAME IS THE POINT: it is the words your people read on the consent screen, so make it your firm, not "Portal".
• Add your logo and your homepage if you want the screen fully branded. Google reviews an application before it shows a logo to accounts outside your own organisation, which takes a few days; sign-in works while that is pending.
• Under Scopes, add openid, email and profile. Pental asks for nothing else, and anything more will be refused by your own consent screen for no benefit.
• Open Credentials, Create credentials, OAuth client ID, Web application.
• Under Authorised redirect URIs, add the address above. Nothing goes in Authorised JavaScript origins.
• Create it, then copy the client ID and the client secret.

Microsoft

• In the Microsoft Entra admin centre, open App registrations, then New registration.
• Name it after your firm, for the same reason.
• Under Supported account types, choose who may sign in. This has to agree with the Directory field in Pental: single tenant goes with your directory ID, any organisational directory goes with organizations, and any Microsoft account goes with common.
• Set the Redirect URI to Web, and paste the address above.
• Register it, then copy the Application (client) ID from Overview and, if you chose single tenant, the Directory (tenant) ID beside it.
• Open Certificates and secrets, New client secret, and copy the VALUE, not the Secret ID. Microsoft shows it once and never again.
• Under API permissions the defaults are enough: openid, email and profile. No admin consent is required for those.

A Microsoft client secret expires, and the maximum is two years. Put the expiry date in a calendar the day you create it. When it lapses, sign-in stops with a message telling your people to contact an administrator; paste a new secret into Pental and it works again immediately.

Putting them into Pental

• In your portal, open Settings, then the login page section.
• Expand "Use your own Google / Microsoft app".
• Paste the client ID and the client secret for each provider you registered, and set the Microsoft directory if you chose single tenant.
• Save the login page.

The secret is encrypted inside your own database on the way in and is never sent back to a browser, so the field is blank on every later visit and the label says Stored. Typing a new one replaces it; leaving it blank leaves the stored one alone. Pental reads it only at the moment somebody signs in, through a signed, audited call from the server.

Check it, and going back

• Sign out, open your portal, and use the Google or Microsoft button. The consent screen should now name your firm.
• If it still names Pental, the client ID is empty or the save did not land. If the provider refuses with a redirect mismatch, the URI registered against the application is not exactly the one your portal prints.
• If Microsoft refuses with an application-not-found error, the Directory field and the Supported account types do not agree.

Clearing the client ID puts that provider back on the shared application, and sign-in keeps working throughout. The same happens by itself if the credentials ever become unreadable: nobody is locked out, they simply see our consent screen again until it is fixed.