SSO Setup

Agents can sign in through an external OpenID Connect provider such as Google or Keycloak.

Note:

You still create agent accounts in libredesk yourself. Signing in with SSO does not create an account.

Configuration

Providers differ in the details, so check your provider's documentation for anything not covered here.

Provider setup

In your provider's admin console, create a new OpenID Connect application/client. Retrieve:

• Client ID
• Client Secret

libredesk configuration

In libredesk, navigate to Security → SSO and click New SSO and enter the following details:

• Provider URL (e.g., the URL of your OpenID provider)
• Client ID
• Client Secret
• A descriptive name for the connection

Redirect URL

After saving, copy the generated Callback URL from libredesk and add it as a valid redirect URI in your provider's client settings.

Provider examples

Keycloak

Log in to your Keycloak Admin Console

Create client

In Keycloak, navigate to Clients and click Create:

• Client ID (e.g., libredesk-app)
• Client Protocol: openid-connect
• Root URL and Web Origins: your app domain (e.g., https://ticket.example.com)
• Under Authentication flow, uncheck everything except the standard flow
• Click save

Configure credentials

Go to the credentials tab:

• Ensure client authenticator is set to Client Id and Secret
• Note down the generated client secret

Configure libredesk SSO

In libredesk, go to Admin → Security → SSO and click New SSO:

• Provider URL (e.g., https://keycloak.example.com/realms/yourrealm)
• Name (e.g., Keycloak)
• Client ID
• Client secret
• Click save

Add redirect URI

1. After saving, click on the three dots and choose Edit to open the new SSO entry
2. Copy the generated Callback URL from libredesk
3. Back in Keycloak, edit the client and add the Callback URL to Valid Redirect URIs:
   • e.g., https://ticket.example.com/api/v1/oidc/1/finish