-
Notifications
You must be signed in to change notification settings - Fork 4
Single Sign On (OIDC)
Sign in with Keycloak, Authentik, Entra ID, Okta, Google Workspace, or anything else that speaks OpenID Connect. Covers both the web console and the RustDesk client itself — the client needs no modification or custom build.
Settings → SSO.
- Copy the callback URL shown at the top of the page and register it with your provider as a valid redirect URI.
-
Provider URL — the issuer, e.g.
https://idp.example.com/realms/main./.well-known/openid-configurationis appended for you, or paste the full discovery URL. - Client ID and Client Secret from the confidential client you created at the provider. The secret is encrypted at rest; leaving the field blank on a later save keeps the stored one.
- Test Connection proves the console can reach the provider and read its signing keys before you switch anything on.
- Turn on Enable single sign-on.
A "Sign in with SSO" button appears on the login page. The label is yours to set.
New users decides what happens when someone authenticates successfully but matches no console account:
| Policy | Result |
|---|---|
| Deny | Only existing accounts may sign in |
| Pending | Account is created, but an administrator must approve it |
| Active | Account is created and signed in immediately |
You can also set a default group for new accounts and an allowed email domains list. Leave the domain list empty to accept any domain the provider authenticates.
Make new SSO users administrators exists but leave it off unless every account your provider authenticates should administer this console.
Identity is keyed on the provider's issuer and subject, not the email address —
sub is the only claim guaranteed stable and unique, while addresses get
reassigned between people.
An email is used only to link an existing local account on first sign-in, and only when the provider marks it verified. An unverified address is refused rather than trusted, because an address a user can set themselves would otherwise be a way to take over an existing account.
Linking an existing account does not remove its password. That account keeps both ways in. Only accounts created by the provider are password-less.
Disable password sign-in hides the username and password form so SSO is the only way in.
It takes effect only while SSO is enabled and configured — meaning the discovery URL, client ID and client secret are all present. Switch SSO off, or clear any of those, and the password form returns by itself.
Be clear about the limit of that: it is a check on the stored configuration, not on the provider. A provider that is down, unreachable or rejecting requests while its settings remain filled in does not bring password sign-in back. For that case, use the environment override below.
If you need to force it off from the shell:
CORTENDESK_OIDC_DISABLED=true
in .env. That overrides the database setting and cannot be undone from the web
interface.
Sign out of the provider too ends the session at the identity provider on logout, not just the console session. If the provider is unreachable, logging out of the console still works.
Once SSO is enabled, the stock RustDesk client shows a "Continue with …" button in its login dialog. Nothing is installed or patched on the client — it asks this console what sign-in options to offer, and the console answers.
The button's wording comes from your login-page label, with the leading verb stripped: set "Sign in with Keycloak" and the client reads "Continue with Keycloak".
Requirements:
- The device must point at this console as its API Server (client Settings → Network → API Server), which is normally already the case.
- The user completes the login in their system browser, then returns to the app.
The client's address book and device list are then scoped to that user exactly as a password login would be.
SSO sessions are exempt from the console's own 2FA enforcement. The identity provider performed the authentication, including whatever second factor it requires, so the console does not ask again.
If the console reaches your provider over an internal address while your users' browsers use a public one — container networks, split DNS — set Browser-facing provider URL under Advanced. Only the URLs the browser is sent to are rewritten; token and key requests keep using the address the console can reach.
Most deployments do not need this.
No SSO button on the login page. SSO is not enabled, or one of provider URL, client ID or client secret is missing.
No button in the RustDesk client. The device is not pointing at this console as its API server. Check client Settings → Network → API Server.
"The ID token was issued by an unexpected issuer." The issuer your provider declares does not match what it returns in tokens. Use Test Connection to see the issuer the console reads.
"Your identity provider has not verified this email address." Working as intended — mark the address verified at the provider, or have an administrator create the account first.
Sign-in fails and you cannot get in at all. Set CORTENDESK_OIDC_DISABLED=true
in .env and restart. Password sign-in returns immediately.