External OIDC secure enrollment

Availability

This feature is available in Business and Enterprise plans. See the pricing page for details.

When External OIDC is enabled, users have the possibility to securely enroll (automatically create a Defguard account) and very easily configure their desktop client just by logging in with the SSO provider.

Step-by-step guide

1. Go to Edge site

1. Click "Launch enrollment"

1. Click "Sign in with Google" (in this example)

For this to work, see OpenID enrollment.

Troubleshooting

Sign in with External SSO section not visible after configuring the external SSO

Make sure the External SSO is configured properly and reachable from the Defguard Core service.

After clicking the Launch enrollment button check the Core service logs. Look for error messages similar to:

ERROR defguard_proxy_manager::handler: message=Failed to setup external OIDC provider client: Authorization error: Failed to discover provider metadata, make sure the URL is correct: http://example.com/realms/master. Error details: Request failed [2.1.0 Debian 13.0.0 x86_64]