PHPackages magedevgroup/module-customer-sso - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. magedevgroup/module-customer-sso ActiveMagento2-module[Authentication & Authorization](/categories/authentication) magedevgroup/module-customer-sso ================================ Storefront SSO capability for Magento 2 — provider-agnostic OIDC login for customers (JIT customer creation, account linking by email/sub, IdP-claim to customer-group mapping). 0.0.2(1mo ago)0011OSL-3.0PHPPHP ~8.3.0||~8.4.0||~8.5.0 Since Jul 8Pushed 1mo agoCompare [ Source](https://github.com/MageDevGroup-com/module-customer-sso)[ Packagist](https://packagist.org/packages/magedevgroup/module-customer-sso)[ RSS](/packages/magedevgroup-module-customer-sso/feed)WikiDiscussions master Synced 1w ago READMEChangelogDependencies (6)Versions (3)Used By (1) MageDevGroup\_CustomerSso ========================= [](#magedevgroup_customersso) > Provider-agnostic single sign-on for the Magento 2 storefront (OIDC). [![License](https://camo.githubusercontent.com/83286826e7422502369a480c1cbde06eae433c866ac3e9054835db7296a11c9c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4f534c2d2d332e302d677265656e)](https://camo.githubusercontent.com/83286826e7422502369a480c1cbde06eae433c866ac3e9054835db7296a11c9c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4f534c2d2d332e302d677265656e) [![Magento](https://camo.githubusercontent.com/74f990c6f6a950cfc7707cb6d3cfdc731382be6260dfab995f14da50230e9117/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d6167656e746f2d322e342d6f72616e6765)](https://camo.githubusercontent.com/74f990c6f6a950cfc7707cb6d3cfdc731382be6260dfab995f14da50230e9117/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d6167656e746f2d322e342d6f72616e6765) [![PHP](https://camo.githubusercontent.com/49c1441e4607accdb38fb505c51c881b13dabea9a2726b234d7ad218befce9fb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e332d2d382e352d626c7565)](https://camo.githubusercontent.com/49c1441e4607accdb38fb505c51c881b13dabea9a2726b234d7ad218befce9fb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e332d2d382e352d626c7565) [![Version](https://camo.githubusercontent.com/6a24c9197bfc07f07d3f136dc182a76b14d3cd2f8d473fbc3729540c9a4c5410/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d302e302e312d6c6967687467726579)](https://camo.githubusercontent.com/6a24c9197bfc07f07d3f136dc182a76b14d3cd2f8d473fbc3729540c9a4c5410/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d302e302e312d6c6967687467726579) This is the storefront-login capability **core**: it logs shoppers in over OIDC but never references a concrete IdP. Install a provider plugin (e.g. `customer-sso-okta`) to bind it to an identity provider. Features -------- [](#features) - **JIT customer creation** — an unknown identity provisions a new `customer_entity` on first sign-in. - **Account linking** by IdP `sub` first, then by email under policy. - **Group mapping** — an IdP claim maps to a Magento customer group. - **Coexists with password login** — the native email/password form stays available (configurable). Installation ------------ [](#installation) Usually installed via a provider plugin, which pulls this core (which pulls `sso-core`): ``` composer require magedevgroup/module-customer-sso-okta bin/magento module:enable MageDevGroup_CustomerSsoOkta MageDevGroup_CustomerSso MageDevGroup_SsoCore bin/magento setup:upgrade ``` Direct install of the core alone: ``` composer require magedevgroup/module-customer-sso bin/magento module:enable MageDevGroup_SsoCore MageDevGroup_CustomerSso bin/magento setup:upgrade ``` Register the module callback URL in your IdP: `https:///customersso/sso/callback`. It must exactly match the storefront URL used at runtime. Configuration ------------- [](#configuration) Admin → Stores → Configuration → **MageDevGroup → Customer SSO → General** (config path `magedevgroup_customer_sso/general/*`). Settings are store-scoped, so SSO can be enabled and tuned per store view. FieldPathNotesEnable Customer SSO`enabled`Master switch; off by default.Identity Provider`active_provider`Dropdown populated by installed provider plugins.Client ID`client_id`OIDC client id from the IdP.Client Secret`client_secret`Stored encrypted.Keep Password Login`allow_password_login`On (default): native email/password form stays visible alongside SSO. Off: form is hidden once SSO is live, making login SSO-only.Account Linking by Email`auto_link_policy``auto` vs `require_verification`. See below.Group to Customer-Group Map`group_customer_group_map`IdP group → customer-group rules. See below.The "Sign in with SSO" button appears on the customer login page when the module is enabled and a provider is selected; it uses the active preset's branding. Setting *Keep Password Login* to *No* hides the native form once SSO is live. As a break-glass, the form stays visible on an unconfigured or broken install (no active provider), so a mis-set toggle can never lock shoppers out. Account linking --------------- [](#account-linking) An SSO identity is matched to a customer in this order: 1. **By IdP `sub`** — the stable subject stored in `magedevgroup_customer_sso_subject` on first link. A customer is EAV/API-backed, so the link lives in its own table rather than a column on the entity. 2. **By email**, governed by `auto_link_policy`: - `auto` — a matching email signs straight into the existing customer. - `require_verification` (default) — email linking is refused until the email is proven, preventing account takeover via an unverified IdP email. 3. **JIT create** — no match → a new `customer_entity` is provisioned from the identity, and the `sub` is stored for stable re-login. `require_verification` is the safe default; switch to `auto` only when the IdP guarantees verified emails. Group → customer-group mapping ------------------------------ [](#group--customer-group-mapping) `group_customer_group_map` takes one rule per line as `idp_group=customer_group_id`, where `customer_group_id` is a Magento `customer_group` id. Blank lines and `#` comments are ignored; on duplicate groups the later line wins. ``` # IdP group Customer group id wholesale=2 vip=3 ``` With no rules configured this is inert: customer groups are never touched, so a store using SSO only for login keeps its manually assigned groups. Once a map exists, groups are resolved on JIT create and refreshed on every login, so IdP group changes take effect at next sign-in. An identity whose groups match no rule reverts to the store's default customer group (`GroupManagementInterface::getDefaultGroup`) — customers always hold a valid group. A rule pointing at a non-existent group id is skipped, leaving the current group unchanged. How it works ------------ [](#how-it-works) 1. Shopper clicks "Sign in with SSO" → `customersso/sso/start` builds the OIDC auth URL (state + nonce + PKCE) via sso-core and the active preset, persists that state in the customer session, then redirects to the IdP. 2. IdP redirects back to `customersso/sso/callback`, which validates `state`, exchanges the code, and normalizes claims into an `Identity` via sso-core. IdP error responses return to the login page with a message. 3. The customer is matched (`sub` → email-under-policy → JIT create) and the `sub` link is stored. 4. The customer group is resolved from IdP groups and the storefront customer session is established. Requirements ------------ [](#requirements) - Magento **2.4.x** - PHP **8.3 – 8.5** Part of the MageDevGroup identity suite --------------------------------------- [](#part-of-the-magedevgroup-identity-suite) RepoRole`sso-core`Shared OIDC engine (installed automatically)`admin-sso` · `admin-sso-`Admin-panel SSO login`customer-sso` · `customer-sso-`Storefront SSO login`admin-scim` · `admin-scim-`Admin-user provisioning (SCIM 2.0)License ------- [](#license) [OSL-3.0](LICENSE) © MageDevGroup. Commercial licensing and support: . ### Health Score 37 — LowBetter than 81% of packages Maintenance91 Actively maintained with recent releases Popularity1 Limited adoption so far Community9 Small or concentrated contributor base Maturity42 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~10 days Total 2 Last Release 38d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/6d5acdc656153eb172422ac03f4a59806116de32da5f861c4b00e4ac7bb9c544?d=identicon)[magedevgroup](/maintainers/magedevgroup) --- Top Contributors [![mageown](https://avatars.githubusercontent.com/u/2058487?v=4)](https://github.com/mageown "mageown (1 commits)") ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/magedevgroup-module-customer-sso/health.svg) ``` [![Health](https://phpackages.com/badges/magedevgroup-module-customer-sso/health.svg)](https://phpackages.com/packages/magedevgroup-module-customer-sso) ``` ### Alternatives [fastly/magento2 Fastly CDN Module for Magento 2.4.x 1564.5M1](/packages/fastly-magento2)[checkoutcom/magento2 Checkout.com Payment Gateway for Magento 2 34280.5k3](/packages/checkoutcom-magento2)[myparcelnl/magento A Magento 2 module that creates MyParcel labels 1861.2k](/packages/myparcelnl-magento)[hryvinskyi/magento2-invisible-captcha Magento 2 multi-provider invisible captcha & bot protection (Google reCAPTCHA v2/v3/Enterprise and Cloudflare Turnstile) for form-level and route-level protection 299.6k](/packages/hryvinskyi-magento2-invisible-captcha)[mage-os/module-automatic-translation Automatic AI content translation for Mage-OS. 3223.7k](/packages/mage-os-module-automatic-translation)[loki/magento2-components Core module for defining Alpine.js components with advanced AJAX features 1015.1k29](/packages/loki-magento2-components) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)