1. cPanel & WHM Documentation
  2. WHM
  3. Security Center
  4. Manage External Authentications
authentication security whmui pluggable

Manage External Authentications

Valid for versions 82 through the latest version

Version:

82

Last modified: June 13, 2024

Looking for this interface?
Note:

Your hosting provider can enable or disable this interface for resellers in WHM's Edit Reseller Nameservers and Privileges interface (WHM >> Home >> Resellers >> Edit Reseller Nameservers and Privileges).

Overview

The Manage External Authentications interface allows you to manage your server’s OpenID Connect-compliant identity providers. Once enabled, your users can use third-party authentication from these identity providers to log in to cPanel, WHM, or Webmail. For example, if you enable cPanelID external authentication from Google®, your users will be able to log into their cPanel servers using their Google credentials.

Important:

To use an external authentication method, you must access your WHM, cPanel, and Webmail accounts via an SSL connection. If you do not access your accounts via an SSL connection, the Log in via cPanelID option will not appear on your accounts’ Login interfaces. For more information, read our How to Configure Your Firewall for cPanel & WHM Services documentation.

Note:
  • You can link one or more external accounts to one or more cPanel accounts, WHM accounts, or Webmail accounts.
  • For external accounts with two-factor authentication enabled, you must authenticate through that identity provider and through any two-factor authentication that you configure on your server.
  • Use the add_authn_link UAPI function to add additional accounts. Once you add more than one account, you can link additional accounts in the login interface.

Configure an identity provider

The Configure tab allows root users to configure the system’s identity provider settings for all users. You can also customize the look of an identity provider.

Note:
  • This tab is only available to resellers with the all privilege. A reseller without this privilege cannot access it. For more information, read our Edit Reseller Nameservers and Privileges interface (WHM » Home » Resellers » Edit Reseller Nameservers and Privileges) documentation.
  • When you perform a cPanel Update (upcp), your server will automatically configure the cPanelID External Authentication identity provider. It will also populate the necessary Client ID and Client Secret information from the license server.
  • You must own an active cPanel license to configure cPanelID. For more information, read our How to Purchase a cPanel License documentation.

To add a new identity provider, perform the following steps:

  1. In the desired identity provider’s row, click Configure. A new interface will appear.
  2. Enter the identity provider’s configuration settings in the appropriate text boxes.
    • Enter your desired colors for the Button color and Button text color text boxes in hexadecimal color format without the number sign symbol (#). For example, ff0000 represents the color red.
    • Enter a Base64-encoded image in the Button icon text box, and then enter the image format for that button icon.
    • Most OpenID Connect-compliant identity providers require Client ID, Client Secret, and Redirect URI entries.
  3. Select the To ensure that the system works correctly, confirm that you have used the above URLs when you configure the provider. checkbox.
  4. Click Save. The list of identity providers will appear.
  5. Set the toggle to the appropriate identity provider for a service from Disabled to Enabled.

To disable an identity provider for a service, click the appropriate switch to toggle the provider from Enabled to Disabled.

Important:
  • If you remove an identity provider, the system will revoke access for all credentials that require that method.
  • The system will automatically disable missing or misconfigured identity provider modules.
  • If you change your server’s hostname, you must update the Redirect URI settings in the configuration settings at the identity provider’s site to reflect the new hostname.

Manage credentials

The Credentials section of the interface lists cPanel service accounts and their external authentication credentials. Resellers can also use this to manage their users’ settings.

To unlink an account from an external authentication provider, perform the following steps:

  1. In the Manage Users tab, click Manage in the appropriate row for that user and service.
  2. Click Unlink next to the appropriate account.
  3. Click Unlink to confirm that you wish to revoke the account.

To associate a local server account with credentials through an authentication method, read our How to Log in to Your Server or Account documentation.

Additional Documentation