SSO Connector

The core of the SSO Connector suite. It gives Drupal a Single Sign-On foundation built on an Identity Provider (IdP) / Service Provider (SP) model: one site authenticates users, many sites trust it. A single admin form sets each site's role. The IdP mints short-lived asymmetric RS256 JSON Web Tokens signed with an RSA private key; every SP verifies them with the IdP's public key and enforces issuer, audience, expiry and single-use replay protection. Everything else in the suite builds on this module.

Features

• IdP/SP role-based architecture configured from one admin form.
• Browser SSO flow: /sso/login, /sso/return-path, /sso/from-idp, /sso/logout.
• Asymmetric RS256 JWT signing and verification with iss/aud enforcement and single-use jti replay protection.
• Machine token endpoint /sso/token protected by a dedicated X-SSO-Key API key, an IP allow-list (CIDR-aware) and core flood control.
• Public-key / JWKS accessor consumed by the OAuth submodule to publish a real /.well-known/jwks.json.
• Optional user synchronisation with a field-level allow-list and a sensitive-field skip list.
• Connected-sites block for surfacing the federation to editors.
• Cache-Control: no-store and page-cache kill switch on all SSO responses.

Security model

Every secret — the RS256 signing key and the token API key — is read from settings.php or State, never from exportable configuration, so secrets never leak into a drush config:export. Tokens are short-lived, audience-bound and single-use.

Requirements

• Drupal core ^11.2 || ^12
• PHP with the OpenSSL extension (RS256)
• firebase/php-jwt ^6.10 (pulled in automatically by Composer)

Installation

composer require drupal/sso_connector
drush en sso_connector

Then generate the IdP keypair and provision the SP public key as described in the module's README.md and docs/BUNDLE.md.

Part of the SSO Connector bundle

This is the mandatory core module. Optional capabilities are separate projects you enable per site and per role:

• SSO Connector OAuth — OAuth 2.0 / OpenID Connect Authorization Server (IdP).
• SSO Connector SAML SP — SAML 2.0 Service Provider (SP).
• SSO Connector Social — social OAuth2/OIDC login (SP).
• SSO Connector 2FA — TOTP and email OTP second factor.
• SSO Connector Cookie — cross-subdomain shared-session cookie.
• SSO Connector Permissions — centralised role/permission management.
• SSO Connector Sync — cross-site entity and config replication.
• SSO Connector Autologout — SSO-aware idle logout.