Skip to main content

Configuration Guide: OIDC Authentication and User Synchronization

If you are using anon-premises infrastructure and choose authentication via the OIDC (OpenID Connect) protocol, it is essential to understand how user accounts are routed and managed between your identity provider and the GLPI interface, especially if the latter has no users (i.e., it was freshly installed at the same time as Medulla).

1. Understanding the Authentication Flow

In this architecture, access management follows a specific path:

  1. Storage: Your OIDC users are provisioned in the local LDAP on the Medulla server.

  2. Authorizations (ACLs): Although authentication is handled by OIDC, access rights and permissions (profiles) are managed directly within GLPI.

Sign of a synchronization issue: If, after logging in via OIDC, you are directed to a blank GLPI page or one without menus, this means your account has not yet been imported into the GLPI database. Without this step, the system cannot assign you a profile or access rights.

Adding users to GLPI when logging in via OIDC is now automatic if:

  • GLPI is installed by default with Medulla
  • Your GLPI is accessible in read-write mode

2. Manual Synchronization Procedure

To activate your users in GLPI, you must establish a connection with the local LDAP directory. Here are the steps to follow:

Step A: Access the synchronization interface

  1. Log in to GLPI with a local administrator account.

  2. Go to the Administration > Users menu.

  3. Click the “LDAP Directory Link” button.

image.png

Step B: Import accounts

  1. Click the Import New Users link.

  2. Click the Search button to list the users in the Medulla LDAP directory.

  3. Select the desired users (or all of them) and confirm the synchronization.

Back to top