Unified Login with Azure AD B2C to Streamline User Authentication and Enhance Security

[saygonka]

Code of Conduct

• I agree to follow this project's Code of Conduct

Contribution description

Hi!

I would like to propose the addition of a feature that allows users to log in and register to the GLPI system using Azure AD B2C. This integration could significantly streamline the onboarding process for new users.

Benefits:

• Faster User Integration: By enabling Azure AD B2C integration, organizations can quickly onboard new users without the need for manual account creation. This can greatly speed up the process and reduce administrative overhead.

• Domain-Based User Validation: The system could validate new users based on the domain configured in the client’s entity. This ensures that only users from allowed domains can register and log in, enhancing security and control.

• SSO Configuration: This feature would facilitate the configuration of Single Sign-On (SSO) without the need to register an enterprise application for each client tenant. This can simplify the setup and maintenance of SSO across multiple client environments.

Why This Solution is Beneficial:

Current solutions require adding login buttons for each registered enterprise application through which users authenticate into GLPI. This means that every new user must select the button corresponding to their organization, potentially revealing the list of organizations with which we collaborate.

Integrating Azure AD B2C addresses this issue. Users can log in seamlessly using a unified method, without needing to see or select between different organizational buttons. This enhances both security and user experience by keeping organizational details concealed and simplifying the login process.

Implementing this feature would provide a more modern and efficient user management experience within GLPI, aligning with current best practices in identity management.

[github-actions]

This issue has been closed as we only track bugs here.

You can open a topic to discuss with community about this enhancement on suggestion website.
You can also contact GLPI editor team directly if you are willing to sponsor this feature.

[trasher]

At least one plugin already exists for that; I do not know what is supported exactly.

[saygonka]

At least one plugin already exists for that; I do not know what is supported exactly.

Maybe I'm missing something, but all the plugins I found require either pre-provisioning users in GLPI, registering an enterprise application in the tenant organization, or providing a choice on the login page in the form of a button. The issue with the current Entra ID integration solution is that we are forced to name the buttons after companies so that non-technical users can log into the system. This allows such users or others to see which organizations we collaborate with.

What I have in mind is integrating new users without needing to make changes to the client tenants.

Please review my request again carefully :)

[trasher]

OK, since I do not know those systems nor those plugins, I may be werong. Anyway, this is not a bug, please open RFE on suggestion website.