SSO Bouncer
This module enhances OpenID Connect by ensuring that users logging in via Keycloak SSO have at least one group assigned, as defined in the role mapping. If a user's group is not authorized for the Drupal instance, access will be denied.
This module extends OpenID Connect functionality to check if a Keycloak SSO account login has at least one group as defined in OpenID Connects role mapping.
Requirements
- Drupal >11
- Existend Keycloak SSO Client
- Drupal OpenID Connect with defined role mappings at
/admin/config/people/openid-connect/settings
Installation
- Install with composer.
composer require drupal/sso_bouncer - Enable the module through the Drupal admin interface or using Drush:
drush en sso_bouncer
Configuration
After installation, you can configure the module by navigating to:
Administration > Configuration > People > SSO Bouncer Settings or /admin/config/people/sso-bouncer
Settings
- Enabled: If SSO Bouncer is enabled or not.
- Client ID: Set the client id of which the role mappings for login check come from.
Usage
The module automatically validates user authentication by checking if the user has valid Keycloak groups for the Drupal instance. If the user's group is not authorized for the current instance, access is denied.
Drush Commands
The module provides several Drush commands for managing SSO Bouncer configuration:
drush sso_bouncer:enable [CLIENT_ID]
drush sso_bouncer:disable
drush sso_bouncer:status
License
This module is licensed under the GNU General Public License version 3.
Depends on
Dependencies of the latest stable release
- openid_connect Drupal core
Required by
Tracked projects that depend on this one
No tracked projects depend on this one yet.
Activity
Release Timeline
Releases
| Version | Type | Core | Notes | Release date | |
|---|---|---|---|---|---|
| 1.0.0 | Stable | 11 | first stable release | Nov 26, 2025 | |
| 1.0.0-alpha1 | Pre-release | 11 | First alpha release | Jun 18, 2025 | |
| 1.x-dev | Dev | 11 | Development branch | Jun 18, 2025 |