Single sign-on (OIDC)

Let your agents sign in to the EPAV Desk panel with their company account at Google, Microsoft, Keycloak or another OpenID Connect provider.

S System · Last updated Oct 9, 2026

Single sign-on lets your agents sign in to the EPAV Desk panel with an account at an OpenID Connect provider your company already uses, such as Google Workspace, Microsoft Entra ID or Keycloak. You add the provider under Admin > Security > SSO, and an agent gets in when the provider returns the email address of their agent account.

Before you start

Every agent who will use single sign-on needs an agent account in EPAV Desk with the same email address as at the provider. Signing in through a provider never creates an account. Add agents under Admin > Teammates > Agents, see Agents and teams.
Managing SSO needs the Manage SSO configuration permission in the agent's role.
Providers name their settings in different ways. For anything not covered here, see your provider's documentation.

Add an SSO provider

At your provider, create an OpenID Connect application for a web app (it may be called a client or an OAuth client) and note its client ID and client secret. The redirect address comes in a later step.
In EPAV Desk, open Admin > Security > SSO and click New SSO.
In Provider, choose Google, Microsoft or Custom. The choice sets the logo of the sign-in button; with Custom you can enter your own Logo URL.
In Name, type the text of the sign-in button, for example Company account.
In Provider URL, enter the issuer address of your provider, for example https://accounts.google.com.
Enter the Client ID and the Client secret from step 1 and click Create.

On saving, EPAV Desk reads the provider's OpenID Connect discovery document from the Provider URL. If that fails, nothing is saved and the error is shown. An error starting with oidc: issuer did not match means the Provider URL differs from the issuer value the provider reports: copy that value exactly, including whether it ends with a slash.

Copy the Callback URL to your provider

The redirect address of an entry appears only after its first save:

On Admin > Security > SSO, click the name of the entry, or choose Edit in its row menu.
Copy the Callback URL. It has the form https://support.example.com/api/v1/oidc/1/finish, with your support address and the number of this entry.
At your provider, add it exactly as shown to the allowed redirect URIs of the application from the first step.

A new entry is enabled as soon as it is created, so its button is already on the sign-in page. Signing in with it works once the provider accepts the Callback URL.

Example: Keycloak

Sign in to the Keycloak admin console and pick the realm that holds your staff accounts.
In "Clients", create a client of the OpenID Connect type with a client ID such as epav-support, client authentication turned on and only the standard flow allowed. Set the root URL and the web origins to your support address, for example https://support.example.com.
On the client's "Credentials" tab, keep the authenticator "Client Id and Secret" and copy the client secret.
In EPAV Desk, click New SSO and enter Custom as Provider, a Name such as Keycloak, the Provider URL https://keycloak.example.com/realms/<your realm>, the Client ID and the Client secret. Click Create.
Open the entry again, copy the Callback URL and add it to "Valid redirect URIs" of the Keycloak client.
Check that each agent's user in the realm has "Email verified" turned on. Keycloak tells EPAV Desk whether an address is verified, and a sign-in with an unverified address is refused.

Example: Google

In the Google Cloud console of your organization, create an OAuth client ID of the type "Web application". If Google asks you to set up the consent screen first, the internal audience keeps sign-in limited to the accounts of your Google Workspace.
In EPAV Desk, click New SSO, keep Google as Provider, and enter a Name, the Provider URL https://accounts.google.com, the Client ID and the Client secret. Click Create.
Open the entry again, copy the Callback URL and add it to the authorized redirect URIs of the Google OAuth client.

Example: Microsoft

Choose Microsoft as Provider. In Microsoft Entra ID, register an application for the web, create a client secret for it, and use the issuer of your directory as Provider URL: https://login.microsoftonline.com/<tenant ID>/v2.0, with your directory (tenant) ID in place of <tenant ID>. The general address with common instead of a tenant ID does not pass the issuer check. After the first save, add the Callback URL as a web redirect URI of the application.

Each enabled SSO entry has its own button on the sign-in page, with its name and logo. The agent clicks it, signs in at the provider and comes back to the panel, on the page they were trying to open.

EPAV Desk asks the provider for the openid, profile and email scopes and takes the email address from the sign-in token. If the provider marks that address as unverified, the sign-in is refused. Otherwise EPAV Desk looks for an agent account with that address, without regard to upper or lower case. If the account exists and is enabled, the agent is signed in. Only agent accounts can sign in this way.

On EPAV Desk the email and password form stays on the sign-in page under the SSO buttons, after Or continue with. It cannot be switched off, so a broken provider setup never locks you out: sign in with your password and correct the entry. See Signing in to the panel.

Choose a provider that verifies email addresses

EPAV Desk matches agents by email address alone. It refuses an address that the provider marks as unverified, but some providers send no such mark, and then the address is accepted as it is. Whoever can sign in at the provider with an agent's email address can therefore sign in as that agent. Connect only a provider where your company controls the accounts and their addresses, such as your own Google Workspace, Microsoft Entra ID directory or Keycloak realm.

Message on the sign-in page	Cause
There is no agent account for the email your SSO provider returned. Contact your administrator for access.	No agent account has this email address, or the provider sent no email address.
Your account is disabled. Contact your administrator.	The agent account exists but is disabled.
Your SSO provider has not verified this email address. Verify it with the provider or contact your administrator.	The provider marked the email address as unverified.
Sign-in is unavailable due to a configuration problem. Ask your administrator to check the SSO client ID and secret.	The provider rejected the Client ID or the Client secret, for example because the secret expired.
The sign-in was cancelled or denied at the identity provider. Try signing in again.	The agent cancelled, or the provider refused access.
Your sign-in session expired. Try signing in again.	The browser no longer had the sign-in cookie, for example because the sign-in started at another address of the panel or cookies are blocked, or an old sign-in link was opened again.
Sign-in failed. Try again, and contact your administrator if it keeps happening.	Any other failure, for example a sign-in token that could not be verified.

If the provider shows its own error about the redirect address, the Callback URL is missing from its allowed redirect URIs or differs from it.

If you change your support address

The Callback URL always uses your current support address. After you move the panel to a new address in the cabinet, open each SSO entry, copy the new Callback URL and add it at the provider; until then, sign-in with that provider fails. Agents should also start signing in at the new address. See Your account and your site.

Turn off, edit or remove SSO

To turn an entry off, open it and clear the Enabled checkbox, then click Save: its button leaves the sign-in page. The stored Client secret is shown masked; leave it as it is to keep it, or type a new one when the provider issues a new secret. Delete in the row menu removes the entry for good.