You still create agent accounts in libredesk yourself. Signing in with SSO does not create an account. libredesk matches the provider’s email address to an existing agent.
Configuration
Providers differ in the details, so check your provider’s documentation for anything not covered here.1
Provider setup
In your provider’s admin console, create a new OpenID Connect application/client. Retrieve:
- Client ID
- Client Secret
2
libredesk configuration
In libredesk, navigate to Admin → Security → SSO, click New SSO, and enter the following details:
- Provider: Google, Microsoft, or Custom
- Name: a descriptive name for the connection
- Provider URL: the issuer URL of your OpenID provider (e.g.,
https://accounts.google.com) - Logo URL (Custom only): the logo shown on the login page
- Client ID
- Client secret
3
Redirect URL
After saving, open the SSO entry and copy the Callback URL. Add it as a valid redirect URI in your provider’s client settings.
Provider examples
Keycloak
1
Log in to your Keycloak Admin Console
2
Create client
In Keycloak, navigate to Clients and click Create:
- Client ID (e.g.,
libredesk-app) - Client Protocol:
openid-connect - Root URL and Web Origins: your app domain (e.g.,
https://ticket.example.com) - Under Authentication flow, uncheck everything except the standard flow
- Click save
3
Configure credentials
Go to the credentials tab:
- Ensure client authenticator is set to
Client Id and Secret - Note down the generated client secret
4
Configure libredesk SSO
In libredesk, go to Admin → Security → SSO and click New SSO:
- Provider:
Custom - Name (e.g.,
Keycloak) - Provider URL (e.g.,
https://keycloak.example.com/realms/yourrealm) - Client ID
- Client secret
- Click Create
5
Add redirect URI
- After saving, click on the three dots and choose Edit to open the new SSO entry
- Copy the generated Callback URL from libredesk
- Back in Keycloak, edit the client and add the Callback URL to Valid Redirect URIs:
- e.g.,
https://ticket.example.com/api/v1/oidc/1/finish
- e.g.,