PHPackages magedevgroup/module-admin-sso - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. magedevgroup/module-admin-sso ActiveMagento2-module[Authentication & Authorization](/categories/authentication) magedevgroup/module-admin-sso ============================= Admin panel SSO capability for Magento 2 — provider-agnostic OIDC login for the admin panel (JIT admin-user creation, IdP-group to ACL-role mapping, enforce-SSO + break-glass). 0.0.2(1mo ago)0013OSL-3.0PHPPHP ~8.3.0||~8.4.0||~8.5.0 Since Jul 8Pushed 1mo agoCompare [ Source](https://github.com/MageDevGroup-com/module-admin-sso)[ Packagist](https://packagist.org/packages/magedevgroup/module-admin-sso)[ RSS](/packages/magedevgroup-module-admin-sso/feed)WikiDiscussions master Synced 1w ago READMEChangelogDependencies (6)Versions (3)Used By (3) MageDevGroup\_AdminSso ====================== [](#magedevgroup_adminsso) > Provider-agnostic single sign-on for the Magento 2 admin panel (OIDC). [![License](https://camo.githubusercontent.com/83286826e7422502369a480c1cbde06eae433c866ac3e9054835db7296a11c9c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4f534c2d2d332e302d677265656e)](https://camo.githubusercontent.com/83286826e7422502369a480c1cbde06eae433c866ac3e9054835db7296a11c9c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4f534c2d2d332e302d677265656e) [![Magento](https://camo.githubusercontent.com/74f990c6f6a950cfc7707cb6d3cfdc731382be6260dfab995f14da50230e9117/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d6167656e746f2d322e342d6f72616e6765)](https://camo.githubusercontent.com/74f990c6f6a950cfc7707cb6d3cfdc731382be6260dfab995f14da50230e9117/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d6167656e746f2d322e342d6f72616e6765) [![PHP](https://camo.githubusercontent.com/49c1441e4607accdb38fb505c51c881b13dabea9a2726b234d7ad218befce9fb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e332d2d382e352d626c7565)](https://camo.githubusercontent.com/49c1441e4607accdb38fb505c51c881b13dabea9a2726b234d7ad218befce9fb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e332d2d382e352d626c7565) [![Version](https://camo.githubusercontent.com/6a24c9197bfc07f07d3f136dc182a76b14d3cd2f8d473fbc3729540c9a4c5410/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d302e302e312d6c6967687467726579)](https://camo.githubusercontent.com/6a24c9197bfc07f07d3f136dc182a76b14d3cd2f8d473fbc3729540c9a4c5410/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d302e302e312d6c6967687467726579) The admin-login **capability core**: it logs staff into the Magento admin backend over OIDC, but never references a concrete IdP. Install a provider plugin (`admin-sso-okta`, `admin-sso-azure`, …) that supplies the IdP; the plugin pulls this core, which in turn pulls the shared OIDC engine `sso-core`. Features -------- [](#features) - **JIT admin-user creation** — matches an admin user by IdP `sub` (or email), creating one on first login. - **IdP-group → ACL-role mapping** — assigns Magento roles from IdP groups on every sign-in. - **Enforce SSO + break-glass** — disable the native login form while keeping a guarded local-admin recovery path. - **2FA interplay** — an IdP-authenticated session satisfies Magento core 2FA, avoiding a double prompt. - **Provider-agnostic** — one core drives any OIDC IdP through a provider preset. Installation ------------ [](#installation) Normally installed via a provider plugin (e.g. `admin-sso-okta`), which pulls this core and `sso-core`: ``` composer require magedevgroup/module-admin-sso-okta bin/magento module:enable MageDevGroup_SsoCore MageDevGroup_AdminSso MageDevGroup_AdminSsoOkta bin/magento setup:upgrade ``` Direct install of the core only: ``` composer require magedevgroup/module-admin-sso bin/magento module:enable MageDevGroup_SsoCore MageDevGroup_AdminSso bin/magento setup:upgrade ``` Register the callback URL in your IdP: `https:////adminsso/sso/callback`, where `` is the backend frontName (default `admin`). It must exactly match the admin URL used at runtime. Configuration ------------- [](#configuration) Admin → Stores → Configuration → **MageDevGroup → Admin SSO → General** (config path `magedevgroup_admin_sso/general/*`). FieldPathNotesEnable Admin SSO`enabled`Master switch; off by default.Identity Provider`active_provider`Dropdown populated by installed provider plugins.Client ID`client_id`OIDC client id from the IdP.Client Secret`client_secret`Stored encrypted.Enforce SSO`enforce_sso`Disables the native login form. See below.Allow Break-Glass Login`break_glass`Guarded local-admin path under enforce. On by default.Group to Role Map`group_role_map`IdP group → ACL role rules. See below.Default Role`default_role`Fallback role when no group matches; empty = deny.A "Sign in with SSO" button appears on the admin login page when the module is enabled and a provider is selected, using the active preset's branding. ### Group → role mapping [](#group--role-mapping) `group_role_map` takes one rule per line as `idp_group=role_id`, where `role_id` is a Magento `authorization_role` id. Blank lines and `#` comments are ignored; on duplicate groups the later line wins. ``` # IdP group Magento role id admins=1 support-team=4 ``` Roles are (re)assigned on every login, so IdP group changes take effect at next sign-in. An identity whose groups match no rule gets `default_role`; if that is empty the user is denied a role. Enforce SSO + break-glass ------------------------- [](#enforce-sso--break-glass) With **Enforce SSO** on, the native username/password admin form is rejected — all sign-in goes through the IdP. To stay recoverable if the IdP is misconfigured, keep **Allow Break-Glass Login** on: a local admin can still sign in by adding `break_glass=1` to the login request: ``` https:///admin?break_glass=1 ``` With break-glass off and enforce on, a lockout is not recoverable from the UI — only by disabling `enforce_sso` via CLI/DB. Leave break-glass on unless you have another recovery path. How it works ------------ [](#how-it-works) 1. User clicks "Sign in with SSO" → `adminsso/sso/start` builds the OIDC auth URL (state + nonce + PKCE) via sso-core and the active preset, then redirects to the IdP. 2. The IdP redirects back to `adminsso/sso/callback`, which validates `state`, exchanges the code, and normalizes claims into an `Identity` via sso-core. 3. JIT: the admin user is matched by IdP `sub` (stored on a unique `admin_user.magedevgroup_sso_subject_id` column added at `setup:upgrade`), falling back to email, and created if absent (with a suffixed username on any local collision). 4. Roles are mapped from IdP groups and the admin backend session is established. 5. The IdP-authenticated session satisfies Magento core 2FA (`Magento_TwoFactorAuth`), so users are not double-prompted. Requirements ------------ [](#requirements) - Magento Open Source / Adobe Commerce **2.4.x** - PHP **8.3 – 8.5** Part of the MageDevGroup identity suite --------------------------------------- [](#part-of-the-magedevgroup-identity-suite) RepoRole`sso-core`Shared OIDC engine (installed automatically)`admin-sso` · `admin-sso-`Admin-panel SSO login`customer-sso` · `customer-sso-`Storefront SSO login`admin-scim` · `admin-scim-`Admin-user provisioning (SCIM 2.0)License ------- [](#license) [OSL-3.0](LICENSE) © MageDevGroup. Commercial licensing and support: . ### Health Score 37 — LowBetter than 81% of packages Maintenance91 Actively maintained with recent releases Popularity1 Limited adoption so far Community12 Small or concentrated contributor base Maturity42 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~10 days Total 2 Last Release 38d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/6d5acdc656153eb172422ac03f4a59806116de32da5f861c4b00e4ac7bb9c544?d=identicon)[magedevgroup](/maintainers/magedevgroup) --- Top Contributors [![mageown](https://avatars.githubusercontent.com/u/2058487?v=4)](https://github.com/mageown "mageown (1 commits)") ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/magedevgroup-module-admin-sso/health.svg) ``` [![Health](https://phpackages.com/badges/magedevgroup-module-admin-sso/health.svg)](https://phpackages.com/packages/magedevgroup-module-admin-sso) ``` ### Alternatives [fastly/magento2 Fastly CDN Module for Magento 2.4.x 1564.5M1](/packages/fastly-magento2)[checkoutcom/magento2 Checkout.com Payment Gateway for Magento 2 34280.5k3](/packages/checkoutcom-magento2)[myparcelnl/magento A Magento 2 module that creates MyParcel labels 1861.2k](/packages/myparcelnl-magento)[hryvinskyi/magento2-invisible-captcha Magento 2 multi-provider invisible captcha & bot protection (Google reCAPTCHA v2/v3/Enterprise and Cloudflare Turnstile) for form-level and route-level protection 299.6k](/packages/hryvinskyi-magento2-invisible-captcha)[mage-os/module-automatic-translation Automatic AI content translation for Mage-OS. 3223.7k](/packages/mage-os-module-automatic-translation)[loki/magento2-components Core module for defining Alpine.js components with advanced AJAX features 1015.1k29](/packages/loki-magento2-components) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)