Skip to content

Black Friday:

60% off

Cliedesk Pro

Every plan, every site count. Ends Cyber Monday.

00 days 00 hrs 00 min 00 sec
Claim 60% off

Administration

Single sign-on and IP allowlist

This guide covers a feature of Cliedesk Pro. The free plugin is a complete help desk; see what Pro adds.

With Cliedesk Pro, your team can sign in with your identity provider (SSO), you can require SSO for some roles, and you can let staff open Cliedesk only from your own addresses. Only Owners can change these settings. They are in Settings → Privacy & security.

Add an identity provider

  1. Go to Settings → Privacy & security → Single sign-on.
  2. Copy the Details for your identity provider into your identity provider (for example Okta, Microsoft Entra ID or Google Workspace): the SAML entity ID and metadata URL and the SAML ACS URL, or the OpenID Connect redirect URI.
  3. Select Add a provider and choose SAML 2.0 or OpenID Connect.
  4. For SAML, enter the Identity provider entity ID, the Sign-in URL (SSO URL) and paste the Signing certificate. For OpenID Connect, enter the Issuer URL, the Client ID and the Client secret.
  5. Optional: in Allowed email domains, list your company domains, for example example.com. Then only accounts with these email domains can be linked.
  6. Select Save provider.

The WordPress sign-in page now shows Sign in with and the provider name. Only people who already have a Cliedesk account can sign in this way. The identity provider must send the same email address as their account. SAML works only on a site that uses HTTPS.

Owners and WordPress administrators link SSO themselves, for safety: sign in with your password, go to Single sign-on and select Link my account next to the provider. After that, you can sign in with SSO.

If you point a provider to another identity provider (a new entity ID or issuer), everyone links again at their next sign-in. Turning a provider off or deleting it signs out everyone who signed in with it.

Require SSO for roles

  1. Under Require SSO for Cliedesk roles, tick People with these roles must sign in with SSO.
  2. Choose the Roles.
  3. Select Save.

Before it saves, Cliedesk checks that nobody gets locked out:

  • At least one WordPress administrator must have two-factor authentication. That person can still use the WordPress password if SSO is down (the “break-glass” sign-in).
  • If your own role needs SSO, you must be signed in with SSO.
  • If other Owners or Admins would lose access, Cliedesk lists them and asks you to confirm.

Other people get a warn-only grace first (24 hours by default). After it, their password no longer works.

Allow staff only from your addresses

  1. Go to Settings → Privacy & security → IP allowlist.
  2. Select Add my address, and add your other addresses or ranges, one per line, for example 203.0.113.0/24 Office.
  3. Tick Allow staff to open Cliedesk only from these addresses.
  4. Select Save IP allowlist.

Cliedesk refuses a list without your current address. The list covers the Cliedesk app, the Cliedesk screens and help articles in wp-admin, and the Cliedesk parts of the WordPress REST API. The website, the chat widget, webhooks and API keys keep working from anywhere. API keys have their own address lists.

If your site is behind a proxy or load balancer, open Behind a proxy or load balancer and list the proxy addresses. Do this only for your own proxy. Very wide ranges are refused (shorter than /8 for IPv4 or /32 for IPv6). Listing your proxy also makes the sign-in limits and the audit log use each person’s own address.

Confirm a change

A new or changed setting works at once, but it turns back by itself after 10 minutes unless you confirm it. Open Cliedesk in a private window or another browser, sign in again (with SSO, or from an address on the list) and select Confirm the change. So a mistake cannot lock you out.

Roles from identity-provider groups

In Settings → Team & roles → Identity-provider groups, add rules: a group name from your identity provider, the role it gives and the teams it adds. Cliedesk applies the rules at every single sign-on. Owners keep their role. People whose role or teams were changed by hand show Changed by hand. Their next sign-in applies the rules again.

If you are locked out

The site owner can switch each protection off without Cliedesk:

  • Add define( 'CLIEDESK_DISABLE_IP_ALLOWLIST', true ); or define( 'CLIEDESK_DISABLE_SSO_REQUIRED', true ); to wp-config.php. Remove the line when you can sign in again.
  • Or run wp cliedesk security set ip_allowlist off or wp cliedesk security set sso_required off.

The protections stay on when the Pro licence ends, so your site is not weakened. Deactivating Cliedesk Pro removes them, after a warning.