Social Identity & CIAM Setup Guide

1. Microsoft Entra External ID (Azure)

1. Log into the Azure Portal. Search for Tenant Creation.
2. Select External (CIAM). Name the tenant Synkronyx ERO.
3. Switch directories into your new External tenant.
4. Go to App Registrations > New Registration.
5. Name: ERO PWA | Type: Single Page Application (SPA) | Redirect URI: http://localhost:4321.
6. Save the Application (client) ID and Directory (tenant) ID.

2. Google OAuth Setup ([email protected])

1. Go to Google Cloud Console signed in as [email protected].
2. Click New Project > Name it ERO-Auth.
3. Go to APIs & Services > OAuth consent screen.
4. User Type: External > Fill in required emails > Publish the app.
5. Go to Credentials > Create Credentials > OAuth client ID.
6. Application Type: Web application.
7. Authorized redirect URIs: https://<your-tenant-name>.ciamlogin.com/<your-tenant-id>/oauth2/authresp
8. Save the Client ID and Client Secret.

3. Facebook OAuth Setup

1. Go to Facebook Developers.
2. Click Create App > Type: Authenticate and request data from users > Not a Game.
3. Name: ERO Auth > Create.
4. Go to Use Cases > Authentication and account creation > Customize.
5. Go to Settings > Add Redirect URI: https://<your-tenant-name>.ciamlogin.com/<your-tenant-id>/oauth2/authresp
6. Go to App Settings > Basic. Save App ID and App Secret.

4. Link IDPs to Entra

1. Go back to your Azure Entra External ID Tenant.
2. Go to External Identities > All identity providers.
3. Add Google: Paste your Google Client ID & Secret.
4. Add Facebook: Paste your Facebook App ID & Secret.
5. Go to User flows > New user flow.
6. Check Google, Facebook, and Email w/ Password.
7. Save.

5. Agent Automation Directives

• ADO Backlog: Append Feature 5.2 (Social Identity Federation) to Epic 5, with tasks covering Google/Facebook integration into Entra CIAM.
• System Design: Update SYSTEM_BUILDER.md to document the Entra External ID architecture for social logins.
• Bootstrapper: Update Section 4 of scripts/bootstrap.ps1 to natively prompt the user for SKNX_ERO_TENANT_ID and SKNX_ERO_CLIENT_ID using Read-Host, and inject them into settings/.env.local.