OpenID Connect in OTOBO – SSO for Agents & Customers

In this guide: Centralize authentication via an external Identity Provider for agents and customer portal users.

Related: OAuth2 email · Customer users · SSO Kerberos · Get support

With OpenID Connect (OIDC), both agents and customer users can be authenticated conveniently and securely in the OTOBO ticket system. User management is handled centrally via an external Identity Provider (IdP) such as Azure AD or Keycloak.

Prerequisites

OTOBO 11 or higher
OpenID Connect-compatible Identity Provider (Azure AD, Keycloak, Auth0, etc.)
Access to the Kernel/Config.pm file

The integration for agents is performed in the Kernel/Config.pm.

Example Configuration

$Self->{AuthModule} = 'Kernel::System::Auth::OpenIDConnect';

$Self->{'AuthModule::OpenIDConnect::Config'}{ClientSettings} = {
    ClientID     => 'YOUR-AGENT-CLIENT-ID',
    ClientSecret => 'YOUR-AGENT-CLIENT-SECRET',
    RedirectURI  => 'https://your-domain.de/otobo/index.pl?Action=Login',
};

$Self->{'AuthModule::OpenIDConnect::Config'}{ProviderSettings} = {
    OpenIDConfiguration => 'https://your-provider.de/.well-known/openid-configuration',
    TTL                 => 1800,
};

$Self->{'AuthModule::OpenIDConnect::AuthRequest'}->{ResponseType}    = ['code'];
$Self->{'AuthModule::OpenIDConnect::AuthRequest'}->{AdditionalScope} = [qw/profile email/];

$Self->{'AuthModule::OpenIDConnect::UID'} = 'email';

$Self->{'AuthModule::OpenIDConnect::UserMap'} = {
    email       => 'UserEmail',
    given_name  => 'UserFirstname',
    family_name => 'UserLastname',
};

# Optional mapping of groups/roles
$Self->{'AuthModule::OpenIDConnect::RoleMap'} = {
    groups => {
        admins  => 'admin',
        support => 'support',
    },
};

# Debugging (temporary)
$Self->{'AuthModule::OpenIDConnect::Debug'}->{'LogIDToken'} = 1;

Customer users can also be authenticated via OpenID Connect.

Example Configuration for Customer Users

$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::OpenIDConnect';

$Self->{'Customer::AuthModule::OpenIDConnect::Config'}{ClientSettings} = {
    ClientID     => 'YOUR-CUSTOMER-CLIENT-ID',
    ClientSecret => 'YOUR-CUSTOMER-CLIENT-SECRET',
    RedirectURI  => 'https://your-domain.de/otobo/customer.pl?Action=Login',
};

$Self->{'Customer::AuthModule::OpenIDConnect::Config'}{ProviderSettings} = {
    OpenIDConfiguration => 'https://your-provider.de/.well-known/openid-configuration',
    TTL                 => 1800,
};

$Self->{'Customer::AuthModule::OpenIDConnect::AuthRequest'}->{ResponseType}    = ['code'];
$Self->{'Customer::AuthModule::OpenIDConnect::AuthRequest'}->{AdditionalScope} = [qw/profile email/];

$Self->{'Customer::AuthModule::OpenIDConnect::UID'} = 'email';

$Self->{'Customer::AuthModule::OpenIDConnect::UserMap'} = {
    email       => 'UserEmail',
    given_name  => 'UserFirstname',
    family_name => 'UserLastname',
};

# Automatic customer user creation
$Self->{'Customer::AuthModule::OpenIDConnect::AutoCreateUser'} = 1;

# Optional debugging
$Self->{'Customer::AuthModule::OpenIDConnect::Debug'}->{'LogIDToken'} = 1;

Optimally Configuring Azure AD (Example)

Register a new app in Azure Active Directory
Add permissions for “openid”, “profile”, and “email”
Set Redirect URIs:
- Agents: https://your-domain.de/otobo/index.pl?Action=Login
- Customers: https://your-domain.de/otobo/customer.pl?Action=Login
Configure claims (given_name, family_name) under “Token Configuration”

After configuration and restarting the web server, agents and customer users can be conveniently authenticated via your external IdP. New users are automatically created in OTOBO, provided this is configured.

Advantages of OIDC Integration in OTOBO

Central and secure authentication
Unified identity management
Automatic user creation
Reduced administrative effort

FAQ: OpenID Connect in OTOBO

From which version does OTOBO support OpenID Connect?

OpenID Connect is supported natively from OTOBO 11 onward — for both agents and customer users.

Does OIDC work with Azure AD / Microsoft Entra ID, Keycloak, and Auth0?

Yes. Any standards-compliant OpenID Connect provider can be connected. You only need the OpenIDConfiguration URL (.well-known/openid-configuration), a client ID, and a client secret.

Are new users created automatically?

For customer users, yes — provided AutoCreateUser is enabled. You control how claims (email, given_name, family_name) map to OTOBO fields via UserMap.

Can I authenticate agents and customers with different providers?

Yes. Agent login (AuthModule) and customer-user login (Customer::AuthModule) are configured separately and can point to different providers and client IDs.

Further Links

Frequently asked questions

Which OTOBO version is required for OpenID Connect?

OpenID Connect login for agents and customer users requires OTOBO 11 or higher.

Where is OpenID Connect configured for agents?

Agent OIDC settings are configured in Kernel/Config.pm using AuthModule OpenIDConnect and related ClientSettings.

Which identity providers work with OTOBO OIDC?

Any OpenID Connect-compatible IdP can be used, including Azure AD, Keycloak, and Auth0.