| Both sides previous revision Previous revision Next revision | Previous revision |
| en:2.0:single_sign_on [2025/05/28 22:43] – [Single-Sign-On using Admidio's User Accounts: SAML 2.0 and OpenId Connect] kainhofer | en:2.0:single_sign_on [2026/08/10 09:51] (current) – kainhofer |
|---|
| ====== Single-Sign-On using Admidio's User Accounts: SAML 2.0 and OpenId Connect ====== | ====== Single Sign-On using Admidio's User Accounts: SAML 2.0 and OpenID Connect ====== |
| |
| Starting with version 5.0, Admidio can be used by other applications to authenticate users against Admidios user base via Single-Sign-On (SSO). When initiating a login to the application, the user is redirected to Admidio to log in, and after successful authentication, is redirected back to the client app and logged in there. The user has to log in only to Admidio and is automatically given access to other (configured) applications. The other applications do not have to store or process any passwords. | Starting with version 5.0, Admidio can be used as a central login system for other applications using Single Sign-On (SSO). |
| |
| The two dominant protocols are the XML-based SAML 2.0((https://wiki.oasis-open.org/security/FrontPage)) and the JSON-based OpenId Connect (OIDC)((https://openid.net/developers/specs/)). Admidio can act as an Identity Provider (IdP) for both protocols. We will describe the configuration in general for both protocols for the following systems: | When a user signs in to a connected application, they are redirected to Admidio for authentication, and after successful login are redirected back to the appplication, where they are automatically signed in. |
| | |
| | Users only need to log in to Admidio and can access other configured applications without entering their username and password again. The connected applications do not need to store or process the users' passwords themselves. |
| | |
| | Admidio supports the two most widely used SSO protocols: |
| | |
| | * **SAML 2.0**(([[https://wiki.oasis-open.org/security/FrontPage|OASIS SAML documentation]])), an XML-based protocol |
| | * **OpenID Connect (OIDC)**(([[https://openid.net/developers/specs/|OpenID Connect specifications]])), an authentication protocol based on OAuth 2.0 |
| | |
| | With both protocols, Admidio authenticates the user and provides the connected application with the information required to sign the user in. In SAML terminology, Admidio acts as an **Identity Provider (IdP)**. In OpenID Connect, the corresponding term is **OpenID Provider (OP)**. |
| | |
| | The following sections describe the general configuration for both protocols using the following systems as examples: |
| |
| |
