SSO Login

Sign in to GLPI with your Microsoft, Google or OpenID provider account

SSO Login adds to the GLPI login page the button to sign in with a Microsoft (Entra ID), Google or any OpenID Connect provider account, such as Keycloak and Okta. Users sign in with the same account as their e-mail, with the company's MFA, and the GLPI profile can come from their security group in Entra. It works on GLPI 11 and GLPI 12.

LicensedGLPI 11 and 12

Features

One GLPI serves several organizations: accept one tenant, a list of tenants or any Microsoft organization. On the first access the module matches the account by the GLPI login and, after that, by the provider's fixed identifier. Local accounts and administrators are not taken over by an external login unless you allow it.

Applications live in Setup > SSO Login, each with the Test tab, which validates the configuration without signing in, plus linked users, logs and history. If you want, whoever opens GLPI goes straight to the Microsoft login, and the local administrator always has a way to sign in with username and password.

Sign in with Microsoft Entra ID, Google and OpenID Connect (Keycloak, Okta and others), with several applications at the same time

GLPI profile, entity and group assigned by rule from Entra security groups or the provider's roles

Multi-tenant for MSPs: one tenant, a list of accepted tenants or any Microsoft organization

Option to go straight to SSO login: whoever opens GLPI goes to Microsoft without seeing the login page

GLPI MFA preserved, with the option to require the provider's MFA, and the client secret stored encrypted

The first access matches by the GLPI login; afterwards the link uses the account's fixed identifier at the provider

Automatic user creation on the first login, optional and limited to the e-mail domains you allow

Signing out of GLPI also ends the session at the provider

Test tab that validates the configuration without signing in, with linked users, logs and history per application

How it works

Step 1

Register the app with the provider

In Entra ID, create the app registration with the redirect URI the module shows ready to copy, generate the client secret and add the email, upn and, for group-based profiles, groups claims.

Step 2

Add the application in GLPI

In Setup > SSO Login, click Add, choose the provider and enter the client ID, the secret and the tenant. The Test tab confirms the configuration before the button appears on the login page.

Step 3

Set the profiles and open access

Create authorization assignment rules with the provider's group as the criterion and activate the application. If you want, turn on the option to go straight to SSO login.

See it in action

A quick tour of what the plugin does in practice.

Video demo coming soon.

Image gallery

Screenshots for this section are coming soon.

Frequently asked questions

No. The module is for GLPI 11 and GLPI 12. On GLPI 10, SSO with Entra ID is done through SAML, with a community plugin.

No. SSO Login plays the same role and does not run alongside it: disable OAuth SSO before installing the module.

Yes. Add the groups claim to the app registration and create an authorization assignment rule with the security group's object ID. The profile is dynamic: whoever leaves the group loses the profile on the next login.

The GLPI login page keeps offering username and password, and a local administrator can always sign in. Even with the option to go straight to SSO login turned on, the login page address with ?noAUTO=1 at the end shows the form.

Protect the password login too

SSO Login takes care of who signs in with the corporate account. Security Guard limits password attempts on the local login, the API and CalDAV and stops brute force, and it is free.

Discover Security Guard

Start using SSO Login

View available plans or read the full article about this module.

View plans Read full article
Need help?