SSO Connector Cookie
This module enables cookie-based Single Sign-On for Drupal sites on common parent domains, allowing users to authenticate once and remain logged in across related subdomains. It works by sharing authentication sessions through signed cookies, providing a centralized SSO experience for portal ecosystems.
Provides cross-subdomain single sign-on for Drupal sites that live under a common parent domain (for example a.example.com and b.example.com). On an authenticated response it writes one AES-256-CBC-encrypted, HMAC-SHA256-signed cookie to the shared parent domain; every participating site validates that cookie locally and logs the user in — with no redirect to, or back-channel call to, the Identity Provider.
Features
- Single signed, encrypted session cookie on the shared parent domain, with a longer-lived refresh cookie.
- Local validation on each site: signature, expiry, issued-at, issuer/audience and per-user revocation — no IdP round-trip.
- Encrypt-then-MAC with HKDF-derived encryption and MAC subkeys and a random IV.
- Key rotation via an embedded key id, with a grace window across old keys.
- Logout genuinely clears the shared cookie across the domain.
- Sliding-expiry refresh (optional) plus login-time issuance.
- Fails closed when no key is present; a random key is seeded on install.
- Host-validated cookie domain to prevent writing a cookie for a domain the site is not part of.
Security model
Cookie encryption and MAC key material lives in settings.php or State, never in exportable configuration.
Requirements
- Drupal core
^11.2 || ^12 - PHP with the OpenSSL extension
- SSO Connector
^1.0 - Sites sharing a common parent domain
Installation
composer require drupal/sso_connector_cookie drush en sso_connector_cookie
Part of the SSO Connector bundle
Requires SSO Connector (core). See the core project for the full suite.