SSO Connector SAML SP

Turns Drupal into a SAML 2.0 Service Provider so users can authenticate against one or more standards-compliant SAML Identity Providers — compatible with any SAML 2.0 IdP, including Microsoft Entra ID, Okta, ADFS and Google Workspace. It performs SP-initiated login, consumes signed assertions with mandatory, content-bound signature validation, maps attributes and roles, provisions or safely links accounts, publishes SP metadata, and handles IdP-initiated Single Logout.

Features

• SP-initiated login (Redirect binding) and signed-assertion consumption (POST binding).
• Mandatory assertion-signature validation bound to the asserted content, resistant to XML Signature Wrapping.
• RSA-SHA-256/384/512 only — SHA-1, MD5 and unsigned assertions are rejected.
• Hardened XML loader: DOCTYPE rejected and network entity loading disabled (XXE / entity-expansion neutralised).
• Full response validation: Issuer, Audience, Conditions timestamps, SubjectConfirmation, Destination and one-time-use replay protection.
• Attribute and role mapping with de-provisioning of managed roles on each login.
• Safe account linking by IdP + NameID with a uid-1 / privileged-account guard; linking to an existing local account is opt-in and off by default.
• Support for multiple IdPs, selected by machine name.
• SP metadata generation and IdP-initiated Single Logout via a signature-validated LogoutRequest.

Requirements

• Drupal core ^11.2 || ^12
• PHP >= 8.1 with the dom, libxml, openssl and zlib extensions
• robrichards/xmlseclibs ^3.1.3 (pulled in automatically by Composer)
• SSO Connector ^1.0

Installation

composer require drupal/sso_connector_saml
drush en sso_connector_saml

Part of the SSO Connector bundle

Requires SSO Connector (core). See the core project for the full suite.