swoopde/contao-sso-bundle

Generic OpenID Connect single sign-on for the Contao 5.3 - 5.7 backend.

v1.0.1 2026-07-28 21:20 UTC

Requires

• php: ^8.2
• contao/core-bundle: ^5.3
• contao/manager-plugin: ^2.13
• firebase/php-jwt: ^6.11 || ^7.0
• monolog/monolog: ^2.9 || ^3.0
• psr/log: ^2.0 || ^3.0
• symfony/cache-contracts: ^3.5
• symfony/config: ^6.4 || ^7.0
• symfony/dependency-injection: ^6.4 || ^7.0
• symfony/event-dispatcher: ^6.4 || ^7.0
• symfony/http-client: ^6.4 || ^7.0
• symfony/http-foundation: ^6.4 || ^7.0
• symfony/http-kernel: ^6.4 || ^7.0
• symfony/routing: ^6.4 || ^7.0
• symfony/security-bundle: ^6.4 || ^7.0
• symfony/security-core: ^6.4 || ^7.0
• symfony/security-http: ^6.4 || ^7.0

Requires (Dev)

• friendsofphp/php-cs-fixer: ^3.0
• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^10.5
• squizlabs/php_codesniffer: ^3.13
• symfony/phpunit-bridge: ^7.3

Conflicts

• contao/manager-plugin: <2.0 || >=3.0

MIT

• SSO
• contao
• oidc
• keycloak
• openid-connect

Published on Packagist.org on 2026-07-28 21:28 UTC

README

swoopde/contao-sso-bundle

🇬🇧 English | 🇩🇪 Deutsch

Generic OpenID Connect SSO for Contao

The Contao SSO Bundle integrates standards-compliant OpenID Connect (OIDC) providers into the Contao backend.

The bundle authenticates users against an external Identity Provider (IdP) while Contao remains the single source of truth for permissions.

Supported and tested with Contao 5.3 and 5.7.

Features

• OpenID Connect Authorization Code Flow with PKCE
• OpenID Discovery (/.well-known/openid-configuration)
• JWKS signature validation
• Backend authentication only (tl_user)
• Automatic backend user provisioning
• Optional linking by OIDC Subject, email or username
• Configurable claim mapping
• Configurable default backend groups
• RP-Initiated Logout
• Local emergency login
• Debug logging with optional credential masking
• Compatible with Keycloak and every standards-compliant OIDC provider

Security Concept

Authentication is delegated to the Identity Provider.

Authorization always remains inside Contao.

The bundle never changes:

• Administrator flag
• Backend groups
• Page mounts
• File mounts
• Themes
• Allowed modules
• Field permissions

This prevents accidental privilege escalation.

Installation

composer require swoopde/contao-sso-bundle:^1.0

php vendor/bin/contao-console contao:migrate
php vendor/bin/contao-console cache:clear

Development Installation

{
  "repositories": [{
    "type":"path",
    "url":"../contao-sso-bundle",
    "options":{"symlink":true}
  }]
}

composer require swoopde/contao-sso-bundle:dev-main -W

Configuration

Configure the bundle in the Contao backend.

Typical settings:

• Issuer
• Client ID
• Client Secret
• Scopes
• Claim Mapping
• Auto Create Users
• Link by Email
• Link by Username
• Default Groups
• Debug Logging

Keycloak

Create a Confidential OpenID Connect Client.

Enable:

• Standard Flow
• Client Authentication

Redirect URI:

https://example.com/contao/sso/callback

Post Logout Redirect URI:

https://example.com/contao/login

User Lookup

The bundle searches users in the following order:

1. OIDC Subject
2. Email (optional)
3. Username (optional)
4. Create new backend user (optional)

Logging

Optional debug logging includes:

• Discovery
• Login
• Callback
• Logout
• Token validation
• Claim mapping
• User lookup
• User creation
• Errors

Sensitive values are masked unless credential logging is enabled.

Emergency Login

Local backend login remains available:

/contao/login?local=1

Compatibility

• Keycloak
• Authentik
• Microsoft Entra ID
• Okta
• Auth0
• Any standards-compliant OIDC provider

Roadmap

• Frontend authentication
• Multiple providers
• Event hooks
• Role mapping

📝 License

MIT License — (c) Andreas Schreck / swoop.de

🧡 Credits

Developed with love for the Contao community. Tested with Contao 5.3 LTS and 5.7.