more work on external authentication