Skip to main content

GLPI

This guide explains how to connect GLPI 11 (asset management and service center) to VaultysHub using OpenID Connect, with the free plugin Single Sign-On (GPL-3).

Which plugin?

The official Teclib plugin, OAuth SSO, requires a GLPI Network subscription. The community plugin Single Sign-On (version 2.x for GLPI 11) offers a generic provider compatible with VaultysHub.

Prerequisites​

  • GLPI 11.0.x, served over HTTPS (for example https://glpi.example.com)
  • The Single Sign-On 2.x plugin (archive singlesignon.tgz from the releases) extracted in plugins/singlesignon, installed and activated (Configuration → Plugins)
  • Administrator access to GLPI and VaultysHub

Configuration in VaultysHub​

  1. Applications → Add: name GLPI, URL https://glpi.example.com/
  2. Type OIDC, then:
    • Redirect URI: https://glpi.example.com/plugins/singlesignon/front/callback.php/provider/1, where 1 is the provider number, displayed by the plugin after registration
    • Allowed scope: openid, email, profile
    • Subject identifier (sub): Email address
    • Require PKCE: disabled (the plugin does not send it)
  3. Note the Client ID ([appid]) and the Client Secret, then assign the application to the relevant users.

The plugin sends the secret in the body of the request (client_secret_post).

Configuration in GLPI​

1. Public address​

The return URL is constructed from the GLPI URL: Configuration → General → Application URL must be the public address (https://glpi.example.com), otherwise the URI sent to VaultysHub is incorrect.

2. Declare VaultysHub​

Configuration → Single Sign-On → Add:

FieldValue
NameVaultysHub
TypeGeneric
Client ID / Client Secretthose of the VaultysHub application
Scopeopenid email profile
Authorize URLhttps://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/auth
Access Token URLhttps://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/token
Resource Owner Details URLhttps://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/userinfo
Use email as identifieryes
Automatic registrationyes, if accounts should be created on first login
Default profile/entityfor example Self-Service and the root entity
Active / defaultyes

Without field matching, the plugin uses the standard claims email, given_name, and family_name, which VaultysHub provides.

Save, then verify that the Return URL displayed by the plugin is indeed the one declared in VaultysHub.

Test​

The GLPI login page displays a VaultysHub button: validate with your VaultysID, you will return logged in.

Troubleshooting​

  • “Invalid redirect URI”: the GLPI application URL (step 1) or the provider number do not match the declared URI.
  • Certificate error: the plugin calls VaultysHub with curl and the PHP certificate store (curl.cainfo); add the certification authority if VaultysHub uses an internal certificate.
  • Insufficient rights: new accounts receive the default profile, as VaultysHub does not pass groups. Assign profiles in GLPI.

Resources​