work on external authentication