SSO Connector Permissions
This module centralizes authorization management for multiple Drupal sites connected via Single Sign-On (SSO). It allows an Identity Provider to manage user roles and access policies across all connected Service Provider sites, ensuring consistent and auditable permission control. The system supports central role mapping, per-user overrides, and automatic role application as part of the SSO process.
Centralised role and permission management for an SSO network. The Identity Provider is the source of truth: it defines per-Service-Provider role mappings and per-user role/permission overrides, resolves each user's effective SP roles, and pushes HMAC-signed updates to registered Service Providers. A Service Provider registers with the IdP, applies inbound pushes, and can pull the full permissions manifest on cron.
Features
- Per-SP role mappings defined on the IdP.
- Per-user role and granular permission overrides (extra / excluded).
- HMAC-SHA256 signed push from IdP to SP, via queue and cron or immediately.
- SP-side manifest pull on cron (throttled), applying roles and permission overrides locally.
- Self-service SP registration with an admin approval gate — no signing key is issued until approved.
- Registration rate limiting.
- Fail-closed HMAC verification with a replay window; privilege-escalation guard that strips restricted permissions and never touches admin roles.
- SSRF-guarded outbound calls (HTTPS only; private/loopback/reserved IPs blocked).
- Optional content and group transfer rules across connected sites (when the Sync module is present).
Security model
The per-site API key, signing secret and registration secret live in settings.php or State, never in exportable configuration. The global SSO JWT secret is never reused for permission signing.
Requirements
- Drupal core
^11.2 || ^12 - PHP
>= 8.1 - SSO Connector
^1.0
Installation
composer require drupal/sso_connector_permissions drush en sso_connector_permissions
Part of the SSO Connector bundle
Requires SSO Connector (core). See the core project for the full suite.