SSO Connector Permissions

Centralised role and permission management for an SSO network. The Identity Provider is the source of truth: it defines per-Service-Provider role mappings and per-user role/permission overrides, resolves each user's effective SP roles, and pushes HMAC-signed updates to registered Service Providers. A Service Provider registers with the IdP, applies inbound pushes, and can pull the full permissions manifest on cron.

Features

• Per-SP role mappings defined on the IdP.
• Per-user role and granular permission overrides (extra / excluded).
• HMAC-SHA256 signed push from IdP to SP, via queue and cron or immediately.
• SP-side manifest pull on cron (throttled), applying roles and permission overrides locally.
• Self-service SP registration with an admin approval gate — no signing key is issued until approved.
• Registration rate limiting.
• Fail-closed HMAC verification with a replay window; privilege-escalation guard that strips restricted permissions and never touches admin roles.
• SSRF-guarded outbound calls (HTTPS only; private/loopback/reserved IPs blocked).
• Optional content and group transfer rules across connected sites (when the Sync module is present).

Security model

The per-site API key, signing secret and registration secret live in settings.php or State, never in exportable configuration. The global SSO JWT secret is never reused for permission signing.

Requirements

• Drupal core ^11.2 || ^12
• PHP >= 8.1
• SSO Connector ^1.0

Installation

composer require drupal/sso_connector_permissions
drush en sso_connector_permissions

Part of the SSO Connector bundle

Requires SSO Connector (core). See the core project for the full suite.