OpenID Connect / OAuth client

The OpenID Connect module provides a pluggable client implementation for the OpenID Connect protocol.

The server implementation of the protocol is provided by the Simple OAuth (OAuth2) & OpenID Connect or the OAuth2 Server modules.

What is OpenID Connect?

http://openid.net/connect:

OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. It allows Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner.

What does the module do?

The module allows you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created.

Google for instance uses OpenID Connect to authenticate users across all of their services. Check out the OpenID Foundation's announcement of launching OpenID Connect.

Features

For a more detailed description and instructions please refer to the documentation.

Supported login providers

Each login provider needs a client, represented by a plugin.
The module ships with the following plugins:

• Generic OAuth 2.0
• Facebook
• Github
• Google
• LinkedIn
• Okta

The generic client allows to you specify the endpoints and is used primarily to login to Drupal sites using the Simple OAuth (OAuth2) & OpenID Connect or the OAuth2 Server modules or PHP sites powered by oauth2-server-php.

The plugin system allows further modules to provide their own clients:

• OpenID Connect Microsoft Azure Active Directory (Drupal 7, 8 and 9)
• Keycloak OpenID Connect (Drupal 8)
• OpenID Connect Single Sign-on (Drupal 7)

Fetching user profile information

Basic user profile information stored by the login provider can be fetched upon login.
The OpenID Connect specification defines a set of standard Claims. Requested user profile information can be saved on the client site, mapping can be configured via a UI.

Sign in block

A standard Drupal block is available to sign in with the login providers for which clients are enabled. A single button is shown for each login provider.

Credits

Thanks to Bojan Živanović for helping to architect the module.

🇺🇦