external authentication provider