Get early access
In this section (15)

Set up OpenID Connect single sign-on for agents

Let agents sign in with Okta, Microsoft Entra ID, Keycloak, Google Workspace or any OpenID Connect provider, with optional SSO only.

2 min read

Available on Pro, Enterprise. Compare plans

With OpenID Connect (OIDC) single sign-on, agents and admins sign in through your identity provider (IdP), such as Okta, Microsoft Entra ID, Keycloak or Google Workspace. People can also get an agent account on their first sign-in.

OIDC single sign-on is part of the Pro plan and up. On Enterprise you can use SAML instead.

At your identity provider

  1. Create an OpenID Connect app (a “web application” with the authorization code flow).
  2. In ChaosDesk, open Admin Center, Security & compliance, Single sign-on and copy the Redirect URI. It looks like https://yourcompany.chaosdesk.io/auth/oidc/callback.
  3. Add it as the redirect (callback) URI of the app.
  4. Note the app’s issuer URL, client ID and client secret.

In ChaosDesk

  1. On the Single sign-on page, in Single sign-on with OpenID Connect, fill in:
    • Button name: shown on the sign-in page, for example “Okta”;
    • Issuer URL: ChaosDesk reads the rest of the provider’s settings from it;
    • Client ID and Client secret;
    • Scopes, if your IdP needs more than the defaults.
  2. Choose Save.
  3. Switch on Turn on single sign-on. Agents now see a sign-in button with your button name.

Options

  • Allowed email domains: only addresses on these domains can sign in.
  • Create agents on first sign-in: people your IdP lets in get an agent account with the default role. When off, only existing agents can sign in.
  • Admin group and Groups claim: members of this IdP group become admins on their first sign-in. The groups claim is the name of the token claim that lists the groups.

How people are matched

The first time someone signs in, ChaosDesk looks for an agent in your workspace with the same email address. If your IdP says the address is not verified, the sign-in is refused. After the first sign-in the account is linked, so a later address change at the IdP does not lock the agent out.

Suspended agents can’t sign in.

SSO only

Switch on SSO only to make single sign-on the only way in. Password, Google and Microsoft sign-in stop working, except for the break-glass admins. You are always one of them, so a broken IdP never locks you out.

If your plan no longer includes OIDC single sign-on, the connection and SSO only are switched off. Your settings are kept.

Two-step verification

ChaosDesk does not ask for its own second step after a single sign-on. Require multi-factor authentication at your IdP.

Remove the connection

Choose Remove. Agents sign in with their other methods again. Accounts created through single sign-on stay.

Was this article helpful?