# OAuth Clients

## Introduction

GLPI 11 introduces a major OAuth 2.0 authentication feature that revolutionizes how third-party applications access your GLPI data. This new functionality enables secure and modern integration with your organization's ecosystem. OAuth 2.0 is a modern authorization protocol that allows third-party applications to access your GLPI resources without sharing your passwords.

## Why Use It?

* **Enhanced Security**: No password sharing
* **Granular Control**: Specific permissions per application
* **Modern Integrations**: Compatible with mobile and web applications
* **Centralized Management**: Instant access revocation
* **Traceability**: Access and usage tracking

## Prerequisites

* **Administrator** profile or rights on **OAuth Clients**
* Access to the **Configuration** menu

## Creating an OAuth Client

Step 1: Navigating the Interface

* In the main menu, click **Configuration**
* Select **OAuth Clients** from the submenu
* On the OAuth Clients page, click **Add**

<div align="left"><figure><img src="https://3503800744-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIiEHKRx5AeABNDLcRlWX%2Fuploads%2FJERS4IASL2R6tNHXxdl9%2Fadd_oauth_clients.png?alt=media&#x26;token=3ed1b80e-1639-464a-bd61-495bcf125d47" alt="" width="475"><figcaption><p>Add a nex client OAuth</p></figcaption></figure></div>

### Basic Information

* **Name**: Descriptive name for the client
* **Comment**: Description of the client (optional)

### Selecting Grants

Choose the authentication type according to your application

<div align="left"><figure><img src="https://3503800744-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIiEHKRx5AeABNDLcRlWX%2Fuploads%2FWnP7pEzu21OUIzBeYD6p%2Fgrant_permissions.png?alt=media&#x26;token=474c79d0-80ca-42e4-b32e-306e0a54ea8b" alt=""><figcaption><p>Select identification's type</p></figcaption></figure></div>

**Authorization Code:** The most secure interactive authentication for applications with users. The user is redirected to GLPI to authenticate, then sent back to the application with a temporary code that is exchanged for a token.

**Password Grant:** Direct authentication with username and password. The application directly requests user credentials and sends them to GLPI to obtain a token.

**Client Credentials:** Machine-to-machine authentication without a human user. The application authenticates solely with its own credentials (client ID/secret), with no specific user involved.

### Defining Scopes (Permissions)

<div align="left"><figure><img src="https://3503800744-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIiEHKRx5AeABNDLcRlWX%2Fuploads%2Fvke09V8KDtFCLDZe1gu5%2Fscope_permissions.png?alt=media&#x26;token=28adb69e-ffe3-41f7-a2db-7eda8bf27688" alt=""><figcaption><p>Define permissions</p></figcaption></figure></div>

* **api**: General access to the GLPI API
* **user**: Information of the logged-in user
* **email**: User's email address
* **inventory**: Submission of inventories
* **status**: System status
* **graphql**: GraphQL interface

### **Save**

* Click **Add** at the bottom of the form
* The OAuth client is created with unique identifiers (ClientID and Client Secret)

<figure><img src="https://3503800744-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIiEHKRx5AeABNDLcRlWX%2Fuploads%2FLVCbElAryFAtFcCQDZct%2Fsave_client_OAuth.png?alt=media&#x26;token=daabffc9-d6af-4859-a759-e21555c21415" alt=""><figcaption><p>SAve your new client OAuth</p></figcaption></figure>

## Configuring the OAuth Client

### Redirect URI

* Edit your OAuth client
* **"Authorized redirect URIs"** section
* Add your application's URLs

<figure><img src="https://3503800744-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIiEHKRx5AeABNDLcRlWX%2Fuploads%2FvXR5HKksY2Ip0byhBgIJ%2Furi_redirection.png?alt=media&#x26;token=f9c99d2c-0a59-4e8c-95fe-eb3dde9eb736" alt=""><figcaption></figcaption></figure>

### IP Restrictions

* **"IP Restrictions"** section
* Add authorized IP addresses

<div align="left"><figure><img src="https://3503800744-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIiEHKRx5AeABNDLcRlWX%2Fuploads%2FQge0UsMHLXBiI18q2wDa%2Fip_restriction.png?alt=media&#x26;token=3e631b00-cb61-40e1-a004-6f131b3756b6" alt=""><figcaption><p>Add IP Restrictions</p></figcaption></figure></div>

## Using the OAuth Client with the Agent

### Enabling Inventory

* In the main menu, click **Administration**
* Select **Inventory** from the submenu
* Check the "**Enable inventory**" checkbox

<figure><img src="https://3503800744-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIiEHKRx5AeABNDLcRlWX%2Fuploads%2F4sUDp5dZaMadVReSdfWN%2Finventory_autorisation.png?alt=media&#x26;token=3555932f-23f3-438b-9f02-e2c187fed600" alt=""><figcaption><p>Enable inventory</p></figcaption></figure>

### Agent Authorization

Once inventory is enabled, the field for **"Agent authentication"** becomes relevant.

In the corresponding **dropdown list**, select **"OAuth – Client credentials"** to use an **OAuth client** as the authentication source.

<figure><img src="https://3503800744-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIiEHKRx5AeABNDLcRlWX%2Fuploads%2FH6DRDZ0CNXq6SnBqto0I%2Fheader_authoriztaion.png?alt=media&#x26;token=477d1cf2-dbb3-40f5-9e9a-49eda31fbeb1" alt=""><figcaption><p>Enable OAuth authentication for GLPI Agents</p></figcaption></figure>

### Creating the OAuth Client

Create an **OAuth client** that will be used by the agent. In the **"Scopes"** section, select **`Inventory`** to authorize access to inventory functionalities.

{% hint style="warning" %}
**Warning:** Remember to **copy the client secret immediately**, as it will only be displayed once and cannot be retrieved later.
{% endhint %}

Once the client is created, carefully keep the following information:

* **Client ID**
* **Client Secret**

These values will be necessary for configuring the agent in the next step.

<div align="left"><figure><img src="https://3503800744-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIiEHKRx5AeABNDLcRlWX%2Fuploads%2FBKCQxknXetR9QSUuLwhK%2Finventory_scope.png?alt=media&#x26;token=a86a3cf6-ad59-4cb5-8b5e-8674e765dc57" alt=""><figcaption><p>Add inventory to scope</p></figcaption></figure></div>

### Connecting to the Agent

To finalize the configuration, add the **`oauth-client-id`** and **`oauth-client-secret`** parameters in the agent's configuration. This information will allow the agent to authenticate correctly with the OAuth server.

* **`oauth-client-id`**: copy/paste the **Client ID** of the OAuth client created previously.
* **`oauth-client-secret`**: copy/paste the **Client Secret** associated with this same OAuth client.

Once these parameters are entered, **save the agent's configuration**. The agent will then automatically use these credentials to obtain an **access token** and communicate securely with the server.

<a href="https://glpi-agent.readthedocs.io/en/1.10/man/glpi-agent.html#server-authentication" class="button secondary">Configure my GLPI agents</a>