SSO Connector Social

Lets anonymous visitors log in or register with social and identity providers over OAuth 2.0 and OpenID Connect. It ships provider plugins for Google, Microsoft (Entra ID), Okta, GitHub, LinkedIn, GitLab, Facebook, Discord, Twitter/X and a configurable generic OAuth2/OIDC provider, plus account linking/unlinking, an optional login block, optional auto-registration, and optional avatar and display-name synchronisation.

Features

• Ten provider plugins plus a configurable generic OAuth2/OIDC provider.
• OIDC id_token verification (JWKS signature plus iss/aud/exp/nonce) for Google, Microsoft (Entra ID), Okta, and the generic provider when an issuer is configured.
• Providers that do not issue an OpenID Connect id_token (GitHub, LinkedIn, GitLab, Facebook, Discord, Twitter/X) fall back to the provider's userinfo endpoint over TLS.
• PKCE for every provider that supports it.
• Account linking with a password-confirmation step and a short-lived, server-side pending link.
• email_verified is never assumed — for example GitHub is treated as verified only when the primary email is confirmed via the API.
• Optional avatar sync with an SSRF-guarded, size-capped, HTTPS-only fetch, and optional display-name sync.
• Themeable social login block for anonymous users.

Requirements

• Drupal core ^11.2 || ^12
• PHP >= 8.1
• SSO Connector ^1.0
• firebase/php-jwt (pulled in automatically by Composer)

Installation

composer require drupal/sso_connector_social
drush en sso_connector_social

Part of the SSO Connector bundle

Requires SSO Connector (core). See the core project for the full suite.