Skip to main content
Drupal is a registered trademark of Dries Buytaert
Release: Configuration Language Lock 1.0.2 — Minor update available for module config_language_lock (1.0.2). Release: Canvas Override 1.0.1 — Minor update available for module canvas_override (1.0.1). Release: Media Remote Image 8.x-1.2 — Minor update available for module media_entity_remote_image (8.x-1.2). Release: IDNA Convert Service (punycode) 2.0.4 — Minor update available for module idna (2.0.4). Release: Bootstrap Cloud 7.1.3 — Minor update available for theme bootstrap_cloud (7.1.3). Release: Token Browser 1.0.2 — Minor update available for module token_browser (1.0.2). Release: Varbase Project 11.0.8 — Minor update available for module varbase_project (11.0.8). Release: Media Remote Image 2.0.0-beta1 — First beta version released for module media_entity_remote_image (2.0.0-beta1). Usage Milestone: Term CSV Export Import — Module term_csv_export_import crossed 1,000 active installs. Security Coverage: Module Scout — Module module_scout now has official Drupal security advisory coverage.

SSO Connector Permissions

Security covered Drupal 11 · not 10
View on drupal.org

This module centralizes authorization management for multiple Drupal sites connected via Single Sign-On (SSO). It allows an Identity Provider to manage user roles and access policies across all connected Service Provider sites, ensuring consistent and auditable permission control. The system supports central role mapping, per-user overrides, and automatic role application as part of the SSO process.

Centralised role and permission management for an SSO network. The Identity Provider is the source of truth: it defines per-Service-Provider role mappings and per-user role/permission overrides, resolves each user's effective SP roles, and pushes HMAC-signed updates to registered Service Providers. A Service Provider registers with the IdP, applies inbound pushes, and can pull the full permissions manifest on cron.

Features

  • Per-SP role mappings defined on the IdP.
  • Per-user role and granular permission overrides (extra / excluded).
  • HMAC-SHA256 signed push from IdP to SP, via queue and cron or immediately.
  • SP-side manifest pull on cron (throttled), applying roles and permission overrides locally.
  • Self-service SP registration with an admin approval gate — no signing key is issued until approved.
  • Registration rate limiting.
  • Fail-closed HMAC verification with a replay window; privilege-escalation guard that strips restricted permissions and never touches admin roles.
  • SSRF-guarded outbound calls (HTTPS only; private/loopback/reserved IPs blocked).
  • Optional content and group transfer rules across connected sites (when the Sync module is present).

Security model

The per-site API key, signing secret and registration secret live in settings.php or State, never in exportable configuration. The global SSO JWT secret is never reused for permission signing.

Requirements

Installation

composer require drupal/sso_connector_permissions
drush en sso_connector_permissions

Part of the SSO Connector bundle

Requires SSO Connector (core). See the core project for the full suite.

Depends on

Dependencies of the latest stable release

  • SSO Connector
  • help Drupal core
  • serialization Drupal core
  • user Drupal core

Required by

Tracked projects that depend on this one

No tracked projects depend on this one yet.

Activity

Tracked releases
3
Tracked since
Apr 2026
Latest release
1 month ago
Releases (12 mo)
3 ▲ from 0
Maintenance
Active

Release Timeline

Releases

Version Type Core Release date
1.0.1 Stable 11 Jul 21, 2026
1.0.0 Stable 11 Jul 18, 2026
1.0.0-beta1 Pre-release 10–11 Apr 26, 2026