# Default authentication provider

**URL:** <https://forum.pritunl.com/t/default-authentication-provider/818>\
**Category:** Pritunl Zero\
**Created:** [February 28, 2023, 3:31pm UTC](https://forum.pritunl.com/t/default-authentication-provider/818 "2023-02-28T15:31:42Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mat](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/e9c0ed/32.png) [@mat](https://forum.pritunl.com/u/mat)\
**Post date:** [February 28, 2023, 3:31pm UTC](https://forum.pritunl.com/t/default-authentication-provider/818/1 "2023-02-28T15:31:43Z")

</div>

Hello,

we use Pritunl Zero Enterprise and have set up Azure AD as authentication provider. All users in the organization use this.

On the login page, however, the local login is always requested and the user have to select the authentication provider first. How can this be changed to use SSO by default without having to make a selection first?

Thank you for the feedback.

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [March 1, 2023, 2:58pm UTC](https://forum.pritunl.com/t/default-authentication-provider/818/2 "2023-03-01T14:58:47Z")

</div>

If all non-single sign-on users are removed the local option will no longer be shown.

---

<div class="post-metadata">

**Author:** ![mat](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/e9c0ed/32.png) [@mat](https://forum.pritunl.com/u/mat)\
**Post date:** [March 2, 2023, 3:59pm UTC](https://forum.pritunl.com/t/default-authentication-provider/818/3 "2023-03-02T15:59:16Z")

</div>

Hello zach,

Thanks very much. However, the selection page is still displayed then, which makes no sense with only one authentication provider.

It would be much better in terms of usability and user administration if the authentication providers can selected per site. If there is only one, it should be used automatically.

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [March 2, 2023, 10:01pm UTC](https://forum.pritunl.com/t/default-authentication-provider/818/4 "2023-03-02T22:01:56Z")

</div>

Directly redirecting to a single sign-on authentication prompt may confuse some users. The login page will also be improved with the next release to include a logo instead just showing the buttons with a plain box.

 ![zero_new_login](https://forum-static.pritunl.com/original/1X/f07a4de3ac4912cb473d413ee1f1efb250105558.png)

---

<div class="post-metadata">

**Author:** ![mat](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/m/e9c0ed/32.png) [@mat](https://forum.pritunl.com/u/mat)\
**Post date:** [March 3, 2023, 10:55am UTC](https://forum.pritunl.com/t/default-authentication-provider/818/5 "2023-03-03T10:55:23Z")

</div>

The use case is actually standard and sense of SSO (direct redirect). For example, if you open Google Services and are previously logged in, no login button is shown first and you are directly redirected to the application. The same applies to Microsoft Services or other.

It is cumbersome for the user if he has x applications that are all integrated in SSO and then always comes to a login page where he has to confirm the login, even if he is already logged in Azure AD through SSO, for example.

A login page that can be designed in more ways makes sense, but for the use case that no login has yet taken place via an authentication provider. These are two different subjects.

Is it likely that you offer that as an option? I can’t make the current implementation available to our users as we would get a lot of criticism.

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [March 3, 2023, 11:00pm UTC](https://forum.pritunl.com/t/default-authentication-provider/818/6 "2023-03-03T23:00:32Z")

</div>

I may add an option for it in the future. You can edit the `login.html` file and search for `bindState();` then place `onAuthProvider(provider.id);` on the next line. The static files are cached on startup so this will require restarting the service.

```auto
sudo nano /usr/share/pritunl-zero/www/login.html
# ctrl+w bindState();
onAuthProvider(provider.id);
sudo systemctl restart pritunl-zero

```

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [March 3, 2023, 11:41pm UTC](https://forum.pritunl.com/t/default-authentication-provider/818/7 "2023-03-03T23:41:28Z")

</div>

This has been added to the codebase for the next release. It is currently a hidden option but may be added to the web console in the future. If Go is installed it can be built from the repository. The `fast_login` option uses the fast redirect if no local users are in the database. The `force_fast_user_login` and `force_fast_service_login` options will force a redirect on user and service logins to the sso even if local users exists in the database. All options require that only 1 sso provider is configured.

```auto
GOPROXY=direct go install github.com/pritunl/pritunl-zero@latest
sudo cp ~/go/bin/pritunl-zero /usr/bin/pritunl-zero

sudo pritunl-zero set app fast_login true
sudo pritunl-zero set app force_fast_user_login true
sudo pritunl-zero set app force_fast_service_login true

```