Set up single sign-on

With single sign-on, people sign in to OGDESK through your organisation’s own identity provider, with the account they already use at work. OGDESK never sees their password. It works on every plan.

Using Microsoft Entra ID, OneLogin or Duo? Follow the guide for your provider instead. Each walks through both sides step by step, with its own video.

• Single sign-on with Microsoft Entra ID (Azure AD)Video, 2:53
• Single sign-on with OneLoginVideo, 2:48
• Single sign-on with DuoVideo, 2:48

For any other provider, this guide covers the steps:

Before you start

• The Tenant Administrator role. A Help Desk Administrator can look at these settings but not change them.
• Administrator access to your identity provider, to register an application.
• Access to your domain’s DNS, to publish a TXT record.
• An OGDESK account of your own on the domain you will verify, so you can test the sign-in yourself.

Everything is on one page: Administration → App settings → Single sign-on. It has three sections, Email domains, Identity provider and How people sign in, and this guide follows them in order.

Step 1 — Claim and verify your email domain

OGDESK decides which identity provider to offer from the domain of the email address somebody types, and only accepts a sign-in for an address on a domain your workspace has proven it controls.

1. 1

   Step 1: Under Email domains, type your domain, for example acme.com, and choose Claim.

2. 2

   Step 2: The domain appears as Unverified, with a TXT record to publish. Copy its Host and Value with the copy buttons.

   

3. 3

   Step 3: At your DNS provider, create a TXT record with exactly that host and value.

   The host looks like _ogdesk-challenge.acme.com and the value like ogdesk-domain-verification=…. Copy the value from the page; it is unique to your workspace.

4. 4

   Step 4: Back in OGDESK, choose Check DNS. Once the record is found, the badge changes to Verified.

   DNS changes can take a while to spread. If no record is found yet, wait a few minutes and try again.

• Each domain is verified separately. Verifying acme.com does not cover eu.acme.com.
• Public mailbox domains such as gmail.com or outlook.com cannot be claimed.
• Single sign-on cannot be switched on until at least one domain is verified.

Step 2 — Register OGDESK in your identity provider

Under Identity provider, choose the Protocol and type a Button label (people see it as “Sign in with …”). Then save with Enable single sign-on. Once it is saved, the read-only rows at the bottom of the section show the addresses your identity provider needs. Until then they show “—”.

Step 3 — Enter your provider’s details in OGDESK

1. 1

   Step 1: For OpenID Connect, fill in the Issuer URL, Client ID and Client secret from the application you registered. Leave Scopes as openid email profile.

   The secret is stored encrypted and never shown again; once saved, the field reads “•••••••• (unchanged)”. Tick Accept addresses the provider does not mark as verified only for a provider such as Entra ID, whose directory controls people’s addresses.

   

2. 2

   Step 2: For SAML 2.0, fill in the Sign-on URL, the IdP entity ID, the NameID format and the provider’s Signing certificate in PEM format (it starts -----BEGIN CERTIFICATE-----).

   Leave Accept sign-ins started at the identity provider off, and start sign-in from the OGDESK sign-in page.

   

3. 3

   Step 3: Leave Email claim blank unless your provider sends the address somewhere unusual, for example in preferred_username or upn.

4. 4

   Step 4: Choose Enable single sign-on (or Save changes when you edit it later).

Step 4 — Turn it on and test it

1. 1

   Step 1: Under How people sign in, tick Offer single sign-on and save. People whose address is on a verified domain now see a sign-in button for your provider.

   

2. 2

   Step 2: Open a private browser window, go to the OGDESK sign-in page, type your work email and choose Continue. A Sign in with … button appears.

3. 3

   Step 3: Choose it, sign in at your identity provider, and you land back in OGDESK, signed in.

4. 4

   Step 4: Back on the Single sign-on tab, Last successful sign-in shows the time you just signed in. If it failed, Last attempt shows why, in red.

Step 5 — Require single sign-on (optional)

Once it works, tick Require it, and turn passwords off and save. The option stays unavailable until somebody has signed in through your provider successfully, because until then nothing shows the setup works.

• The sign-in page then shows only the single sign-on button for addresses on your verified domains.
• Password sessions that are already open stop renewing, so everybody is on single sign-on within about 15 minutes.
• It applies to everybody in this workspace, administrators included.

Managing people with single sign-on

• Invite people first. Somebody who is not a member sees “That account is not a member of this workspace.” An invited person can accept by signing in with single sign-on, without choosing a password.
• Everybody’s address must be on a verified domain. Verify every domain your people use.
• Removing somebody takes two steps: disable them at your identity provider, and remove them in OGDESK.

If something goes wrong

People see a short message; the full reason is on the Single sign-on tab, next to Last attempt. Check there first.

Every change to the provider and every domain claimed, verified or released is recorded in the audit trail.