Single Sign-On (SSO)

Sign in with your Google or Microsoft account instead of managing a separate Fesk password. SSO is faster for your team and one fewer credential to remember.

Signing in with SSO

On the sign-in page, click Sign in with Google (or the applicable provider). Fesk redirects you to the provider's consent screen where you authorize access. After approval, you're back in Fesk, no extra steps.

• Existing account: if the email from your provider matches a Fesk account, the social identity is linked automatically. You can continue using either your password or SSO going forward.
• New user: Fesk creates an account for you on the spot (free tier) and lands you in the onboarding flow.

Supported providers

| Provider | Identity provider ID | |----------|---------------------| | Google | Google | | Microsoft / Azure AD | (via Cognito hosted UI) |

Your workspace admin configures which providers are available. If you don't see a social sign-in button, SSO hasn't been enabled for your instance.

Account linking

When you first use SSO with an email that already has a password-based Fesk account, the two identities are merged automatically. You keep your existing tickets, settings, and role, nothing changes except that you now have a second way to sign in.

There is no manual "link / unlink" step in the settings UI. Linking is transparent and happens exactly once, on the first social sign-in with a matching email.

Security

• Verified email required: the identity provider must confirm the email address. Unverified email claims are rejected.
• CSRF protection: a one-time state nonce (stored server-side in Valkey, 5-minute TTL) plus an HttpOnly cookie prevent cross-site login attacks.
• Rate limiting: the callback endpoint is rate-limited per IP (10 attempts per 5 minutes) to prevent brute-force code exchange.
• Seat enforcement: if all accounts linked to your user are at the active-seat limit, sign-in is refused with a clear error.

FAQ

Can I disable SSO after linking? You can always sign in with your password instead. Social identity linking is invisible and doesn't remove your password.

Does SSO bypass MFA? Yes, when signing in via a provider, Fesk trusts the provider's authentication. If your Google account has 2FA, that satisfies the second factor. Fesk's own TOTP setup applies only to password-based sign-in.

What happens if my email changes at the provider? Fesk identifies you by the provider's unique subject ID, not the email alone. An email change on the provider side does not break the link.