SSO Connector
SSO Connector provides a robust foundation for Single Sign-On (SSO) in Drupal, allowing users to authenticate once and securely access multiple connected sites. It supports configuring sites as either Identity Providers or Service Providers, with secure browser-based SSO flows and JWT token handling. Optional submodules extend functionality with OAuth, social login, advanced user synchronization, and permission management.
The core of the SSO Connector suite. It gives Drupal a Single Sign-On foundation built on an Identity Provider (IdP) / Service Provider (SP) model: one site authenticates users, many sites trust it. A single admin form sets each site's role. The IdP mints short-lived asymmetric RS256 JSON Web Tokens signed with an RSA private key; every SP verifies them with the IdP's public key and enforces issuer, audience, expiry and single-use replay protection. Everything else in the suite builds on this module.
Features
- IdP/SP role-based architecture configured from one admin form.
- Browser SSO flow:
/sso/login,/sso/return-path,/sso/from-idp,/sso/logout. - Asymmetric RS256 JWT signing and verification with
iss/audenforcement and single-usejtireplay protection. - Machine token endpoint
/sso/tokenprotected by a dedicatedX-SSO-KeyAPI key, an IP allow-list (CIDR-aware) and core flood control. - Public-key / JWKS accessor consumed by the OAuth submodule to publish a real
/.well-known/jwks.json. - Optional user synchronisation with a field-level allow-list and a sensitive-field skip list.
- Connected-sites block for surfacing the federation to editors.
Cache-Control: no-storeand page-cache kill switch on all SSO responses.
Security model
Every secret — the RS256 signing key and the token API key — is read from settings.php or State, never from exportable configuration, so secrets never leak into a drush config:export. Tokens are short-lived, audience-bound and single-use.
Requirements
- Drupal core
^11.2 || ^12 - PHP with the OpenSSL extension (RS256)
firebase/php-jwt ^6.10(pulled in automatically by Composer)
Installation
composer require drupal/sso_connector drush en sso_connector
Then generate the IdP keypair and provision the SP public key as described in the module's README.md and docs/BUNDLE.md.
Part of the SSO Connector bundle
This is the mandatory core module. Optional capabilities are separate projects you enable per site and per role:
- SSO Connector OAuth — OAuth 2.0 / OpenID Connect Authorization Server (IdP).
- SSO Connector SAML SP — SAML 2.0 Service Provider (SP).
- SSO Connector Social — social OAuth2/OIDC login (SP).
- SSO Connector 2FA — TOTP and email OTP second factor.
- SSO Connector Cookie — cross-subdomain shared-session cookie.
- SSO Connector Permissions — centralised role/permission management.
- SSO Connector Sync — cross-site entity and config replication.
- SSO Connector Autologout — SSO-aware idle logout.