README

VezoLabs SSO Login is an enterprise-grade Single Sign-On (SSO) bundle built for Pimcore 12 Studio. It enables seamless SAML 2.0 authentication with Microsoft Entra ID (Azure AD) and generic SAML identity providers.

Technical administrators install the package once via Composer. From that point forward, all routine SSO management—identity provider setup, SAML metadata ingestion, claim mapping, role assignments, JIT provisioning, certificate rotation, and audit monitoring—is handled entirely through the Pimcore Studio UI (accessible via System → SSO Login).

Screenshots & Interface

Identity Providers Dashboard	SAML Setup Wizard

Role & Attribute Mapping	Security Audit Logs
:---:	:---:

Video Walkthrough

A video walkthrough covering installation, Microsoft Entra ID configuration, and role mappings will be linked here.

Key Features

Native Pimcore 12 Studio UI: Built with React 18, TypeScript, and Module Federation. Registers directly into Studio navigation (System → SSO Login) and injects branded SSO buttons into the Studio login form via slot renderers. Zero legacy ExtJS dependencies.
Microsoft Entra ID Wizard: A step-by-step 7-stage configuration guide providing instant copyable Service Provider endpoints (Entity ID, ACS URL, Metadata URL).
Flexible Metadata Ingestion: Upload Federation Metadata XML, fetch dynamically from remote HTTPS URLs with live preview, or configure SAML endpoints manually.
Enterprise SAML 2.0 Security:
- Full cryptographic verification powered by onelogin/php-saml and robrichards/xmlseclibs.
- Enforced SHA-256 (RSA-SHA256 signatures and SHA256 message digests).
- Strict XML External Entity (XXE) injection protection.
- Server-Side Request Forgery (SSRF) filters blocking loopback, link-local, and private RFC 1918 CIDRs.
Visual Attribute & Role Mapping:
- Map SAML assertion claims to Pimcore user profile properties.
- Map external roles or Azure AD groups to Pimcore roles without writing code.
- Configurable unmapped policies: Deny Access (default), Restricted Role, or Manual Approval.
- Role revocation policies on login while preserving local Pimcore roles.
- Hardened against unauthorized super-admin elevation.
Just-in-Time (JIT) User Provisioning:
- Automatically provisions users on their first SSO login.
- Automatic username sanitization and collision deduplication.
- Domain restrictions to whitelist specific corporate email domains.
- Enforcement of disabled account policies.
Dual Certificate Rollover:
- Supports Primary and Secondary (Rollover) X.509 signing certificates simultaneously for zero-downtime key rotation.
- Real-time expiration tracking, health alerts, and fingerprint calculations (SHA-1 / SHA-256).
- Built-in self-signed SP certificate generator.
Comprehensive Audit Trail:
- Logs every authentication attempt with timestamp, user ID, status, failure reasons, mapped roles, IP address, user agent, and correlation ID.
Emergency Local Access:
- When local login is hidden or auto-redirect is enabled, administrators can bypass SSO at any time using ?local=1 (e.g., /pimcore-studio/login?local=1).
CLI Utilities:
- bin/console vezolabs:sso:test: Run pre-flight health diagnostics.
- bin/console vezolabs:sso:rotate-cert: Promote rollover certificates in a single step.

System Requirements & Compatibility

Requirement	Supported Version
Pimcore	Pimcore 12 with Studio UI
PHP	`^8.2`, `^8.3`, `^8.4`, `^8.5`
Database	MariaDB 10.6+ or MySQL 8.0+
PHP Extensions	`openssl`, `dom`, `libxml`, `mbstring`, `json`, `pdo_mysql`

Legacy Pimcore Support & Customization

Need SSO for an earlier Pimcore version, or require bespoke enterprise integration?

Pimcore 6, Pimcore 10, or Pimcore 11: We maintain dedicated builds and backports tailored for classic Pimcore architectures.
Custom Identity Providers & Protocols: Custom claims engines, multi-tenant directory synchronizations, SCIM provisioning, and OpenID Connect (OIDC).

👉 Contact VezoLabs for Customization & Legacy Support

Installation

Quick One-Line Install

Run the following command in your Pimcore project root:

composer require vezolabs/pimcore-sso-login-bundle && \
bin/console pimcore:bundle:install VezolabsSsoLoginBundle && \
bin/console assets:install public && \
bin/console cache:clear

Step-by-Step Installation

1. Require Package via Composer

composer require vezolabs/pimcore-sso-login-bundle

2. Enable Bundle

If not auto-registered by Symfony Flex, add the bundle to config/bundles.php:

return [
    // ...
    Vezolabs\SsoLoginBundle\VezolabsSsoLoginBundle::class => ['all' => true],
];

3. Run Bundle Installer & Migrations

bin/console pimcore:bundle:install VezolabsSsoLoginBundle

4. Publish Frontend Assets & Clear Cache

bin/console assets:install public
bin/console cache:clear

5. Verify Installation

bin/console pimcore:bundle:list
bin/console vezolabs:sso:test

Quick Start Guide

Log into Pimcore Studio (/pimcore-studio/) with administrator credentials.
In the left navigation dock, click System (shield icon) → SSO Login.
Open the Entra ID Wizard tab:
- Copy the generated Entity ID and ACS URL into your Microsoft Entra Enterprise Application.
- Download the Federation Metadata XML from Azure and upload it into Step 4 (or enter your App Federation Metadata URL).
Go to Role Mapping:
- Map your incoming Azure application roles or groups to your target Pimcore roles.
In Provisioning Settings:
- Configure your allowed email domains and account creation rules.
Click Test Configuration to verify your SAML response without affecting existing users.
Switch the provider status to Enabled. The SSO login button will appear on the Studio login page.

Emergency Local Login Access

If your external identity provider experiences downtime or signing certificates expire, administrators can bypass SSO redirection by appending ?local=1 to the login URL:

https://your-domain.com/pimcore-studio/login?local=1

This immediately renders the native username and password form.

CLI Commands

Health Diagnostics

Analyze provider configuration against our 10-point SAML checklist:

bin/console vezolabs:sso:test
bin/console vezolabs:sso:test entra-id

Promote Rollover Certificate

Promote a secondary rollover certificate to primary without touching code:

bin/console vezolabs:sso:rotate-cert entra-id

Documentation

Detailed documentation is available in the docs/ directory:

Contributing

Contributions are welcome. Please read CONTRIBUTING.md for development workflow, coding standards, and testing procedures.

To run the automated PHPUnit test suite:

vendor/bin/phpunit -c phpunit.xml.dist

License

This project is licensed under the MIT License.

Commercial Support & Consulting

VezoLabs provides professional consulting, enterprise deployment, and custom Pimcore development.

Website: https://vezolabs.com
Inquiries: https://vezolabs.com/contact

vezolabs / pimcore-sso-login-bundle

Package info

Security

Statistics