| Both sides previous revision Previous revision Next revision | Previous revision |
| en:2.0:single_sign_on [2025/05/05 23:12] – [C. Configuring Admidio with the Relying Party] kainhofer | en:2.0:single_sign_on [2026/08/10 09:51] (current) – kainhofer |
|---|
| ====== Single-Sign-On using Admidio's User Accounts: SAML 2.0 and OpenId Connect ====== | ====== Single Sign-On using Admidio's User Accounts: SAML 2.0 and OpenID Connect ====== |
| |
| Starting with version 5.0, Admidio can be used by other applications to authenticate users against Admidios user base via Single-Sign-On (SSO). When initiating a login to the application, the user is redirected to Admidio to log in, and after successful authentication, is redirected back to the client app and logged in there. The user has to log in only to Admidio and is automatically given access to other (configured) applications. The other applications do not have to store or process any passwords. | Starting with version 5.0, Admidio can be used as a central login system for other applications using Single Sign-On (SSO). |
| |
| The two dominant protocols are the XML-based SAML 2.0((https://wiki.oasis-open.org/security/FrontPage)) and the JSON-based OpenId Connect (OIDC)((https://openid.net/developers/specs/)). Admidio can act as an Identity Provider (IdP) for both protocols. We will describe the configuration in general for both protocols for the following systems: | When a user signs in to a connected application, they are redirected to Admidio for authentication, and after successful login are redirected back to the appplication, where they are automatically signed in. |
| | |
| | Users only need to log in to Admidio and can access other configured applications without entering their username and password again. The connected applications do not need to store or process the users' passwords themselves. |
| | |
| | Admidio supports the two most widely used SSO protocols: |
| | |
| | * **SAML 2.0**(([[https://wiki.oasis-open.org/security/FrontPage|OASIS SAML documentation]])), an XML-based protocol |
| | * **OpenID Connect (OIDC)**(([[https://openid.net/developers/specs/|OpenID Connect specifications]])), an authentication protocol based on OAuth 2.0 |
| | |
| | With both protocols, Admidio authenticates the user and provides the connected application with the information required to sign the user in. In SAML terminology, Admidio acts as an **Identity Provider (IdP)**. In OpenID Connect, the corresponding term is **OpenID Provider (OP)**. |
| | |
| | The following sections describe the general configuration for both protocols using the following systems as examples: |
| |
| |
| ^ Client ^ SAML 2.0 ^ OpenID Connect ^ Notes | | ^ Client ^ SAML 2.0 ^ OpenID Connect ^ Notes | |
| ^ {{:en:2.0:sso:logos:nextcloud.svg?40&nolink|Nextcloud}} Nextcloud | [[en:2.0:single_sign_on:saml_nextcloud|SAML 2.0 with Nextcloud]] | [[en:2.0:single_sign_on:oidc_nextcloud|OpenID with Nextcloud]] | | ^ {{:en:2.0:sso:logos:nextcloud.svg?40&nolink|Nextcloud}} Nextcloud | [[en:2.0:single_sign_on:saml_nextcloud|SAML 2.0 with Nextcloud]] | [[en:2.0:single_sign_on:oidc_nextcloud|OpenID with Nextcloud]] | |
| ^ {{:en:2.0:sso:logos:dokuwiki.png?45&nolink|DokuWiki}} DokuWiki | [[en:2.0:single_sign_on:saml_dokuwiki|SAML 2.0 with DokuWiki]] | [[en:2.0:single_sign_on:oidc_dokuwiki|OpenID with DokuWiki]] | | | ^ {{:en:2.0:sso:logos:dokuwiki.png?40&nolink|DokuWiki}} DokuWiki | [[en:2.0:single_sign_on:saml_dokuwiki|SAML 2.0 with DokuWiki]] | [[en:2.0:single_sign_on:oidc_dokuwiki|OpenID with DokuWiki]] | | |
| ^ {{:en:2.0:sso:logos:wordpress-logotype-standard.png?150&nolink|Wordpress}} | [[en:2.0:single_sign_on:saml_wordpress|SAML 2.0 with Wordpress]] | [[en:2.0:single_sign_on:oidc_wordpress|OpenID with Wordpress]] | | | ^ {{:en:2.0:sso:logos:wordpress-logotype-standard.png?120&nolink|Wordpress}} | [[en:2.0:single_sign_on:saml_wordpress|SAML 2.0 with Wordpress]] | [[en:2.0:single_sign_on:oidc_wordpress|OpenID with Wordpress]] | | |
| ^ {{:en:2.0:sso:logos:joomla.png?120&nolink|Joomla}} | [[en:2.0:single_sign_on:saml_joomla|SAML 2.0 with Joomla]] | [[en:2.0:single_sign_on:oidc_joomla|OpenID with Joomla]] | | | ^ {{:en:2.0:sso:logos:joomla.png?120&nolink|Joomla}} | [[en:2.0:single_sign_on:saml_joomla|SAML 2.0 with Joomla]] | [[en:2.0:single_sign_on:oidc_joomla|OpenID with Joomla]] | | |
| ^ {{:en:2.0:sso:logos:mediawiki.svg?120&nolink|MediaWiki}} | [[en:2.0:single_sign_on:saml_mediawiki|SAML 2.0 with MediaWiki]] | [[en:2.0:single_sign_on:oidc_mediawiki|OpenID with MediaWiki]] | | | ^ {{:en:2.0:sso:logos:mediawiki.svg?120&nolink|MediaWiki}} | [[en:2.0:single_sign_on:saml_mediawiki|SAML 2.0 with MediaWiki]] | [[en:2.0:single_sign_on:oidc_mediawiki|OpenID with MediaWiki]] | | |
| ^ {{:en:2.0:sso:logos:moodle.png?150&nolink|Moodle}} | [[en:2.0:single_sign_on:saml_moodle|SAML 2.0 with Moodle]] | [[en:2.0:single_sign_on:oidc_moodle|OpenID with Moodle]] | | | ^ {{:en:2.0:sso:logos:moodle.png?90&nolink|Moodle}} | [[en:2.0:single_sign_on:saml_moodle|SAML 2.0 with Moodle]] | [[en:2.0:single_sign_on:oidc_moodle|OpenID with Moodle]] | | |
| ^ {{:en:2.0:sso:logos:gitlab.svg?110&nolink|Gitlab}} | [[en:2.0:single_sign_on:saml_gitlab|SAML 2.0 with Gitlab]] | [[en:2.0:single_sign_on:oidc_gitlab|OpenID with Gitlab]] | | | ^ {{:en:2.0:sso:logos:gitlab.svg?100&nolink|Gitlab}} | [[en:2.0:single_sign_on:saml_gitlab|SAML 2.0 with Gitlab]] | [[en:2.0:single_sign_on:oidc_gitlab|OpenID with Gitlab]] | | |
| ^ {{:en:2.0:sso:logos:odoo_logo.svg?80&nolink|Odoo}} | [[en:2.0:single_sign_on:saml_odoo|SAML 2.0 with Odoo]] | [[en:2.0:single_sign_on:oidc_odoo|OpenID with Odoo]] | | | ^ {{:en:2.0:sso:logos:odoo_logo.svg?60&nolink|Odoo}} | [[en:2.0:single_sign_on:saml_odoo|SAML 2.0 with Odoo]] | [[en:2.0:single_sign_on:oidc_odoo|OpenID with Odoo]] | | |
| ^ {{:en:2.0:sso:logos:keycloak.svg?120&nolink|Keycloak}} | [[en:2.0:single_sign_on:saml_keycloak|SAML 2.0 with Keycloak]] | [[en:2.0:single_sign_on:oidc_keycloak|OpenID with Keycloak]] | | | ^ {{:en:2.0:sso:logos:keycloak.svg?120&nolink|Keycloak}} | [[en:2.0:single_sign_on:saml_keycloak|SAML 2.0 with Keycloak]] | [[en:2.0:single_sign_on:oidc_keycloak|OpenID with Keycloak]] | | |
| ^ {{:en:2.0:sso:logos:simplesamlphp.png?140&nolink|SimpleSAMLphp}} | [[en:2.0:single_sign_on:simplesamlphp|SAML 2.0 with SimpleSAMLphp]] | | | | ^ {{:en:2.0:sso:logos:simplesamlphp.png?140&nolink|SimpleSAMLphp}} | [[en:2.0:single_sign_on:simplesamlphp|SAML 2.0 with SimpleSAMLphp]] | | | |
| | | ^ {{:en:2.0:sso:logos:matomo_logo.svg?120&nolink|Matomo}} | | [[en:2.0:single_sign_on:oidc_matomo|OpenID with Matomo]] | | |
| | ^ {{:en:2.0:sso:logos:gnu_mailman_logo2010.png?120&nolink|Mailman3}} | | [[en:2.0:single_sign_on:oidc_mailman3|OpenID with Mailman3]] | | |
| | ^ {{:en:2.0:sso:logos:plesk_logo_primary_positive_.jpg?60&nolink|Plesk}} | | [[en:2.0:single_sign_on:oidc_plesk|OpenID with Plesk]] | | |
| |
| Other systems like Prestashop do not provide any freely available SAML plugin, only some very expensive commercial extensions. | Other systems like Prestashop do not provide any freely available SAML or OpenID plugin, only some very expensive commercial extensions. |
| |
| |
