Configuration Guide: OIDC Authentication and User Synchronization

If you are using anon-premises infrastructure and have chosen authentication via the OIDC (OpenID Connect) protocol, it is essential to understand how user accounts are routed and managed between your identity provider and the GLPI interface, especially if the latter is empty of users (having been freshly installed alongside Medulla).

1. Understanding the Authentication Flow

In this architecture, access management follows a specific path:

1. Storage: Your OIDC users are provisioned in the Medulla server’s local LDAP.

2. Authorizations (ACL): Although authentication is managed by OIDC, access rights and permissions (profiles) are controlled directly within GLPI.

Sign of a synchronization issue: If, after logging in via OIDC, you land on a blank GLPI page or one without menus, this means your account has not yet been imported into the GLPI database. Without this step, the system cannot assign you a profile or access rights.

Adding users to GLPI when logging in via OIDC is now automatic if:

• GLPI is installed by default with Medulla
• Your GLPI is accessible in read-write mode

2. Manual synchronization procedure

To activate your users in GLPI, you must establish a connection with the local LDAP directory. Here are the steps to follow:

Step A: Access the linking interface

1. Log in to GLPI with a local administrator account.

2. Go to the Administration > Users menu.

3. Click the LDAP Directory Link button.

Step B: Import accounts

1. Click the Import New Users link.

2. Click the Search button to list the users in the Medulla LDAP directory.

3. Select the desired users (or all of them) and confirm the synchronization.