Custom SSO

UnDesked's Custom SSO connector works with any identity provider (IdP) that supports OpenID Connect (OIDC), including Okta, OneLogin, and Ping.

This guide walks through the setup using the standard OIDC values your IdP provides.

Before you start

You will need:

• Admin access to your UnDesked account (to open the Custom SSO screen).
• Administrator access to your identity provider (to create an app/client).
• The UnDesked sign-in redirect URI: [CONFIRM: e.g. https://app.undesked.com/backend/login/callback]. This is the address your IdP returns users to after they authenticate. It is not the same as the "SSO URL Login" field on the Custom SSO screen. If you are unsure, use the "Click here for full instructions" link at the top of the Custom SSO screen or contact UnDesked support.

Two fields on the screen are generated for you and are read-only:

• SSO URL Login (https://app.undesked.com/backend/login?identifier=your-company): the URL your users visit to sign in through SSO. Use it to test the connection at the end.
• SSO identifier (Company): your unique company identifier, already embedded in the login URL above.
  
  

Step 1: Create an OIDC app in your identity provider

In your IdP's admin console, create a new application (the exact wording varies by provider):

1. Choose OIDC / OpenID Connect as the sign-in method.
2. Choose Web application as the application type.
3. Set the grant type to Authorization Code.
4. Set the sign-in redirect URI (sometimes called the callback or reply URL) to the UnDesked redirect URI from the section above.
5. Assign the users or groups who should be allowed to sign in. Only assigned users can authenticate.
6. Save the application.

Step 2: Collect the values from your identity provider

After creating the app, gather these from your IdP:

• Client ID (sometimes "Application ID").
• Client Secret (generate one if the IdP does not create it automatically, and copy it immediately, some providers show it only once).
• Authorization endpoint, Token endpoint, and User Info endpoint.

Most providers publish the three endpoints at a discovery URL. Open your IdP's OpenID configuration (commonly https://your-idp-domain/.well-known/openid-configuration) and note the values labeled authorization_endpoint, token_endpoint, and userinfo_endpoint. Make sure all three come from the same discovery document.

Step 3: Fill in the Custom SSO screen in UnDesked

Step 4: Set Admin Permissions (optional)

Use Admin Permissions to grant signed-in users administrative access. Click Add Permission Set and choose:

• Client: the client the permission applies to.
• Location: the location within that client.
• Role: the admin role to grant.

Add one permission set per client/location/role combination your admins need. If you leave this empty ("No data found"), users sign in without additional admin rights. [CONFIRM: exact role behavior with UnDesked]

Step 5: Save and test

1. Click Save.
2. Open the SSO URL Login value in a private or incognito window.
3. You should be redirected to your identity provider, prompted to sign in, and returned to UnDesked signed in.
   
   

Troubleshooting

• "redirect_uri mismatch" or an IdP error page: the sign-in redirect URI configured in your IdP must exactly match the UnDesked redirect URI, including https://, the full path, and any trailing slash.
• "invalid scope" or missing user details: the Scope field must include openid. Keep openid email profile unless UnDesked support advises otherwise.
• User reaches the IdP but cannot get in: confirm the user (or their group) is assigned to the application in your IdP.
• Endpoints rejected: confirm the authorization, token, and user info endpoints were all copied from the same OpenID configuration and that the provider domain matches across all three.