PHPackages                             magedevgroup/module-sso-core - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. magedevgroup/module-sso-core

ActiveMagento2-module[Authentication & Authorization](/categories/authentication)

magedevgroup/module-sso-core
============================

Shared OIDC/SSO engine for MageDevGroup identity products (generic OIDC client, mapping engine, provider preset contract).

0.0.1(1mo ago)0012OSL-3.0PHPPHP ~8.3.0||~8.4.0||~8.5.0

Since Jul 8Pushed 1mo agoCompare

[ Source](https://github.com/MageDevGroup-com/module-sso-core)[ Packagist](https://packagist.org/packages/magedevgroup/module-sso-core)[ RSS](/packages/magedevgroup-module-sso-core/feed)WikiDiscussions master Synced 1w ago

READMEChangelogDependencies (3)Versions (2)Used By (2)

MageDevGroup\_SsoCore
=====================

[](#magedevgroup_ssocore)

> Shared OIDC engine for the MageDevGroup SSO suite — the single dependency every login product builds on.

[![License](https://camo.githubusercontent.com/83286826e7422502369a480c1cbde06eae433c866ac3e9054835db7296a11c9c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4f534c2d2d332e302d677265656e)](https://camo.githubusercontent.com/83286826e7422502369a480c1cbde06eae433c866ac3e9054835db7296a11c9c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4f534c2d2d332e302d677265656e) [![Magento](https://camo.githubusercontent.com/74f990c6f6a950cfc7707cb6d3cfdc731382be6260dfab995f14da50230e9117/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d6167656e746f2d322e342d6f72616e6765)](https://camo.githubusercontent.com/74f990c6f6a950cfc7707cb6d3cfdc731382be6260dfab995f14da50230e9117/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d6167656e746f2d322e342d6f72616e6765) [![PHP](https://camo.githubusercontent.com/49c1441e4607accdb38fb505c51c881b13dabea9a2726b234d7ad218befce9fb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e332d2d382e352d626c7565)](https://camo.githubusercontent.com/49c1441e4607accdb38fb505c51c881b13dabea9a2726b234d7ad218befce9fb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e332d2d382e352d626c7565) [![Version](https://camo.githubusercontent.com/6a24c9197bfc07f07d3f136dc182a76b14d3cd2f8d473fbc3729540c9a4c5410/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d302e302e312d6c6967687467726579)](https://camo.githubusercontent.com/6a24c9197bfc07f07d3f136dc182a76b14d3cd2f8d473fbc3729540c9a4c5410/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d302e302e312d6c6967687467726579)

The shared OIDC/SSO engine for the MageDevGroup identity suite. It is installed transitively by every login product (`admin-sso-okta`, `customer-sso-okta`, ...), so you rarely require it directly.

What it provides
----------------

[](#what-it-provides)

Ships **protocol only** — no UI, no config, no secret storage. Products own configuration and supply a small `ProviderPreset`; the engine does the OIDC work. Scope v1 is **OIDC** (authorization-code + PKCE); SAML is a later phase.

- Generic OIDC client: discovery, authorization request, token exchange, ID-token validation against JWKS, claim → identity normalization.
- A stateless group/claim **mapping engine** (IdP values → target keys).
- A `ProviderPreset` contract so IdP differences (discovery URL, scopes, groups claim, branding) stay in a provider plugin module — one engine serves any compliant IdP.

OIDC flow
---------

[](#oidc-flow)

1. **Discovery** — `DiscoveryClient::discover($url)` fetches (and caches) `.well-known/openid-configuration` → `ProviderMetadata` (issuer, authorization, token, JWKS endpoints).
2. **Authorization request** — `AuthorizationRequestFactory::create()` builds the redirect URL with `state`, `nonce`, and a PKCE `S256` challenge. It returns an `AuthorizationRequest` (implements `AuthorizationStateInterface`); the consumer persists that state via `AuthorizationStateStorageInterface` before redirecting.
3. **Callback** — the consumer reloads the state with `consume($state)` (one-time; replay-protected).
4. **Token exchange** — `TokenClient::exchangeCode()` redeems the code with the PKCE verifier at the token endpoint → `TokenResponse` (carries the `id_token`).
5. **ID-token validation** — `JwksClient::getKeySet()` resolves the JWKS; `IdTokenValidator::validate()` verifies the JWS signature (asymmetric algorithms only — no `none`/`HS*`) and the `iss`/`aud`/`exp`/`nonce` claims → validated claims.
6. **Normalization** — `IdentityFactory::create($claims, $preset)` maps `sub`, `email`, `name`, and the preset's groups claim into an `IdentityInterface`.
7. **Mapping** — `MappingEngine::resolve($groups, $rules, $default)` turns IdP groups into target keys (e.g. Magento role ids).

`state` guards CSRF, `nonce` guards replay, PKCE binds the code to the client that started the flow.

The ProviderPreset contract
---------------------------

[](#the-providerpreset-contract)

`Api/ProviderPresetInterface` is the only IdP-specific surface. A provider plugin module (e.g. `admin-sso-okta`) implements it and registers the preset into the capability core's `PresetRegistry`. sso-core itself holds no registry and no IdP-specific code.

MethodPurpose`getCode()`Stable machine code (`okta`, `azure`).`getLabel()`Human-readable IdP name for the admin UI.`buildDiscoveryUrl(array $config)`Discovery URL from the product's resolved config.`getDefaultScopes()`Scopes to request (always includes `openid`).`getGroupsClaim()`Claim carrying groups (`groups`), or `null`.`getButtonLabel()`Login-button label.`getButtonIconUrl()`Login-button icon URL, or `null`.How products consume the engine
-------------------------------

[](#how-products-consume-the-engine)

Install pulls the core transitively:

```
composer require magedevgroup/module-admin-sso-okta   # pulls magedevgroup/module-sso-core

```

A product wires the flow using only the public surface — build the auth URL from its preset, validate the ID token, normalize an Identity, map groups:

```
$authRequest = $authorizationRequestFactory->create(
    $metadata->getAuthorizationEndpoint(),
    $clientId,
    $redirectUri,
    $preset->getDefaultScopes()
);
$stateStorage->save($authRequest);           // persist before redirect
// redirect user to $authRequest->getUrl()

// --- on callback ---
$state  = $stateStorage->consume($stateParam);
$tokens = $tokenClient->exchangeCode(
    $metadata->getTokenEndpoint(),
    $code,
    $redirectUri,
    $clientId,
    $state->getCodeVerifier(),
    $clientSecret
);
$claims = $idTokenValidator->validate(
    $tokens->getIdToken(),
    $jwksClient->getKeySet($metadata->getJwksUri()),
    $metadata->getIssuer(),
    $clientId,
    $state->getNonce()
);
$identity = $identityFactory->create($claims, $preset);
$roles    = $mappingEngine->resolve($identity->getGroups(), $groupRules, $defaultRole);
```

The engine never stores secrets — the product passes already-resolved client id/secret and owns the `AuthorizationStateStorageInterface` implementation (session, cache, ...).

Public API (`Api/`)
-------------------

[](#public-api-api)

Stable contracts products depend on. Full method docs live in the interface files.

InterfaceRole`Api/ProviderPresetInterface`IdP preset a product supplies to the engine.`Api/Data/IdentityInterface`Provider-agnostic normalized identity (`getSubjectId`, `getEmail`, `getName`, `getGroups`).`Api/AuthorizationStateStorageInterface`Product-owned persistence of the one-time auth state (`save`, `consume`).`Api/Data/AuthorizationStateInterface`The one-time state itself (`getState`, `getNonce`, `getCodeVerifier`).Requirements
------------

[](#requirements)

- Magento Open Source / Adobe Commerce **2.4.x**
- PHP **8.3 – 8.5**
- `magento/framework >=103.0`
- `web-token/jwt-framework ^4.0`

Part of the MageDevGroup identity suite
---------------------------------------

[](#part-of-the-magedevgroup-identity-suite)

RepoRole`sso-core`Shared OIDC engine (installed automatically)`admin-sso` · `admin-sso-`Admin-panel SSO login`customer-sso` · `customer-sso-`Storefront SSO login`admin-scim` · `admin-scim-`Admin-user provisioning (SCIM 2.0)License
-------

[](#license)

[OSL-3.0](LICENSE) © MageDevGroup. Commercial licensing and support: .

###  Health Score

37

—

LowBetter than 81% of packages

Maintenance90

Actively maintained with recent releases

Popularity1

Limited adoption so far

Community13

Small or concentrated contributor base

Maturity41

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

49d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/6d5acdc656153eb172422ac03f4a59806116de32da5f861c4b00e4ac7bb9c544?d=identicon)[magedevgroup](/maintainers/magedevgroup)

---

Top Contributors

[![mageown](https://avatars.githubusercontent.com/u/2058487?v=4)](https://github.com/mageown "mageown (1 commits)")

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/magedevgroup-module-sso-core/health.svg)

```
[![Health](https://phpackages.com/badges/magedevgroup-module-sso-core/health.svg)](https://phpackages.com/packages/magedevgroup-module-sso-core)
```

###  Alternatives

[fastly/magento2

Fastly CDN Module for Magento 2.4.x

1564.5M1](/packages/fastly-magento2)[simplesamlphp/simplesamlphp-module-oidc

A SimpleSAMLphp module adding support for the OpenID Connect protocol

5018.6k1](/packages/simplesamlphp-simplesamlphp-module-oidc)[myparcelnl/magento

A Magento 2 module that creates MyParcel labels

1861.2k](/packages/myparcelnl-magento)[hryvinskyi/magento2-invisible-captcha

Magento 2 multi-provider invisible captcha & bot protection (Google reCAPTCHA v2/v3/Enterprise and Cloudflare Turnstile) for form-level and route-level protection

299.6k](/packages/hryvinskyi-magento2-invisible-captcha)[mage-os/module-automatic-translation

Automatic AI content translation for Mage-OS.

3223.7k](/packages/mage-os-module-automatic-translation)[sproutcms/cms

Enterprise content management and framework

243.0k4](/packages/sproutcms-cms)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)