PHPackages swoopde/contao-sso-bundle - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. swoopde/contao-sso-bundle ActiveContao-bundle swoopde/contao-sso-bundle ========================= Generic OpenID Connect single sign-on for the Contao 5.3 - 5.7 backend. v1.0.0(today)00LGPL-3.0-or-laterPHPPHP ^8.2CI passing Since Jul 28Pushed todayCompare [ Source](https://github.com/swoopDe/contao-sso-bundle)[ Packagist](https://packagist.org/packages/swoopde/contao-sso-bundle)[ Docs](https://github.com/swoopde/contao-sso-bundle)[ RSS](/packages/swoopde-contao-sso-bundle/feed)WikiDiscussions main Synced today READMEChangelogDependencies (20)Versions (2)Used By (0) ![Contao Cookiebar](_docs/logo/swoop.svg) swoopde/contao-sso-bundle ========================= [](#swoopdecontao-sso-bundle) ๐Ÿ‡ฌ๐Ÿ‡ง English | [๐Ÿ‡ฉ๐Ÿ‡ช Deutsch](../../../../../../home/as/Downloads/README.de.md) Generic OpenID Connect SSO for Contao ------------------------------------- [](#generic-openid-connect-sso-for-contao) The **Contao SSO Bundle** integrates standards-compliant **OpenID Connect (OIDC)** providers into the Contao backend. The bundle authenticates users against an external Identity Provider (IdP) while **Contao remains the single source of truth for permissions**. Supported and tested with **Contao 5.3 and 5.7**. Features -------- [](#features) - OpenID Connect Authorization Code Flow with PKCE - OpenID Discovery (`/.well-known/openid-configuration`) - JWKS signature validation - Backend authentication only (`tl_user`) - Automatic backend user provisioning - Optional linking by OIDC Subject, email or username - Configurable claim mapping - Configurable default backend groups - RP-Initiated Logout - Local emergency login - Debug logging with optional credential masking - Compatible with Keycloak and every standards-compliant OIDC provider Security Concept ---------------- [](#security-concept) Authentication is delegated to the Identity Provider. Authorization always remains inside Contao. The bundle **never** changes: - Administrator flag - Backend groups - Page mounts - File mounts - Themes - Allowed modules - Field permissions This prevents accidental privilege escalation. Installation ------------ [](#installation) ``` composer require swoopde/contao-sso-bundle:^1.0 php vendor/bin/contao-console contao:migrate php vendor/bin/contao-console cache:clear ``` Development Installation ------------------------ [](#development-installation) ``` { "repositories": [{ "type":"path", "url":"../contao-sso-bundle", "options":{"symlink":true} }] } ``` ``` composer require swoopde/contao-sso-bundle:dev-main -W ``` Configuration ------------- [](#configuration) Configure the bundle in the Contao backend. Typical settings: - Issuer - Client ID - Client Secret - Scopes - Claim Mapping - Auto Create Users - Link by Email - Link by Username - Default Groups - Debug Logging Keycloak -------- [](#keycloak) Create a Confidential OpenID Connect Client. Enable: - Standard Flow - Client Authentication Redirect URI: ``` https://example.com/contao/sso/callback ``` Post Logout Redirect URI: ``` https://example.com/contao/login ``` User Lookup ----------- [](#user-lookup) The bundle searches users in the following order: 1. OIDC Subject 2. Email (optional) 3. Username (optional) 4. Create new backend user (optional) Logging ------- [](#logging) Optional debug logging includes: - Discovery - Login - Callback - Logout - Token validation - Claim mapping - User lookup - User creation - Errors Sensitive values are masked unless credential logging is enabled. Emergency Login --------------- [](#emergency-login) Local backend login remains available: ``` /contao/login?local=1 ``` Compatibility ------------- [](#compatibility) - Keycloak - Authentik - Microsoft Entra ID - Okta - Auth0 - Any standards-compliant OIDC provider Roadmap ------- [](#roadmap) - Frontend authentication - Multiple providers - Event hooks - Role mapping --- ### ๐Ÿ“ License [](#-license) MIT License โ€” (c) Andreas Schreck / swoop.de --- ### ๐Ÿงก Credits [](#-credits) Developed with love for the Contao community. Tested with Contao 5.3 LTS and 5.7. ### Health Score 39 โ€” LowBetter than 84% of packages Maintenance100 Actively maintained with recent releases Popularity0 Limited adoption so far Community6 Small or concentrated contributor base Maturity45 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits โ€” single point of failure How is this calculated?**Maintenance (25%)** โ€” Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** โ€” Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** โ€” Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** โ€” Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Unknown Total 1 Last Release 0d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/68287505?v=4)[schreck78](/maintainers/schreck78)[@schreck78](https://github.com/schreck78) --- Top Contributors [![schreck78](https://avatars.githubusercontent.com/u/68287505?v=4)](https://github.com/schreck78 "schreck78 (14 commits)") --- Tags SSOcontaoOpenID Connectkeycloakoidc ### Code Quality TestsPHPUnit Static AnalysisPHPStan Code StylePHP\_CodeSniffer Type Coverage Yes ### Embed Badge ![Health badge](/badges/swoopde-contao-sso-bundle/health.svg) ``` [![Health](https://phpackages.com/badges/swoopde-contao-sso-bundle/health.svg)](https://phpackages.com/packages/swoopde-contao-sso-bundle) ``` ### Alternatives [shopware/core Shopware platform is the core for all Shopware ecommerce products. 585.6M606](/packages/shopware-core)[sylius/sylius E-Commerce platform for PHP, based on Symfony framework. 8.5k5.9M754](/packages/sylius-sylius)[oro/platform Business Application Platform (BAP) 645143.5k116](/packages/oro-platform)[contao/core-bundle Contao Open Source CMS 1231.6M2.9k](/packages/contao-core-bundle)[contao-community-alliance/dc-general Universal data container for Contao 1680.8k92](/packages/contao-community-alliance-dc-general)[open-dxp/opendxp Content & Product Management Framework (CMS/PIM) 9421.6k64](/packages/open-dxp-opendxp) PHPackages ยฉ 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)