SSO Connector Cookie

Provides cross-subdomain single sign-on for Drupal sites that live under a common parent domain (for example a.example.com and b.example.com). On an authenticated response it writes one AES-256-CBC-encrypted, HMAC-SHA256-signed cookie to the shared parent domain; every participating site validates that cookie locally and logs the user in — with no redirect to, or back-channel call to, the Identity Provider.

Features

• Single signed, encrypted session cookie on the shared parent domain, with a longer-lived refresh cookie.
• Local validation on each site: signature, expiry, issued-at, issuer/audience and per-user revocation — no IdP round-trip.
• Encrypt-then-MAC with HKDF-derived encryption and MAC subkeys and a random IV.
• Key rotation via an embedded key id, with a grace window across old keys.
• Logout genuinely clears the shared cookie across the domain.
• Sliding-expiry refresh (optional) plus login-time issuance.
• Fails closed when no key is present; a random key is seeded on install.
• Host-validated cookie domain to prevent writing a cookie for a domain the site is not part of.

Security model

Cookie encryption and MAC key material lives in settings.php or State, never in exportable configuration.

Requirements

• Drupal core ^11.2 || ^12
• PHP with the OpenSSL extension
• SSO Connector ^1.0
• Sites sharing a common parent domain

Installation

composer require drupal/sso_connector_cookie
drush en sso_connector_cookie

Part of the SSO Connector bundle

Requires SSO Connector (core). See the core project for the full suite.