Keyway SSO: SAML 2.0 and OpenID Connect sign-in for the Craft 5 control panel (disclosure: our plugin, paid)

[vypeoux-glitch]

Disclosure first: I'm posting for Aphex Coding — we built this plugin and sell it on the Craft Plugin Store (99 USD, renewals 39 USD/year and optional).

Why it exists. Craft ships no SAML provider and no generic OpenID Connect provider for the control panel. Core SSO support exists from Craft 5.3 for Enterprise only, and it is scaffolding marked internal. Keyway is built for the agency or IT department that has been told single sign-on is a condition of the deployment — the kind of requirement that arrives with a security policy or an audit attached.

What it does

• SAML 2.0 (HTTP-POST binding) or OpenID Connect (Authorization Code with PKCE, discovery) for the control panel login
• maps provider attributes onto Craft user fields and provider groups onto Craft groups (group assignment needs Craft Pro)
• just-in-time accounts: create on first login, update on every login, or match an existing account — each its own switch
• a password fallback with an anti-lockout guard: a settings combination that would leave nobody able to sign in if the provider broke gets admin password login switched back on, with a warning (it checks settings, not accounts — keep a real emergency account with a local password)
• a diagnostics screen inside the CP that records every sign-in attempt that reaches a connection: the stage it reached, the outcome, a reason code (domain_not_allowed, state_rejected, …) and, since 1.0.2, what the provider actually said (e.g. a wrong OIDC client secret shows Token endpoint answered HTTP 401: unauthorized_client instead of a generic failure)

How we built it — the parts that took the longest

• SAML first, OIDC second. OIDC on its own is a day's work with league/oauth2-client. The value is in SAML: XML signatures, encrypted assertions, metadata exchange — the code where a mistake means an authentication bypass. Signed assertions are required and that check cannot be switched off.
• The diagnostics screen came before the polish. Almost every SSO support thread is "why did my login fail?", and the answer is usually one attribute name or one clock. So every attempt is written down, with provider values masked when stored and the history pruned to 30 days or 2000 rows.
• Verified against live systems, not just mocks: SAML with Keycloak 26.0 and with Okta (Integrator Free Plan) end to end on 17 September 2026; OpenID Connect with Keycloak 26.0 end to end on 30 September 2026. The Microsoft Entra ID guide is written from Microsoft's documentation and is not yet verified against a live tenant — it says so itself. Encrypted SAML assertions are covered by automated tests with real encryption, not yet run against a live provider.

What it deliberately does not do (better here than after purchase): logins start from the Craft site (SP-initiated only, no IdP tiles); SAML authentication requests are sent unsigned, so a provider that requires signed requests will refuse every login; one provider at a time; no SCIM or LDAP; a transient NameID doesn't work; needs Craft 5 Team or higher, and on Team just-in-time accounts stop at five because that is Craft's own user limit.

Plugin Store: https://plugins.craftcms.com/keyway-sso
Docs, including the full list of limits: https://keyway.aphexcoding.tech/

Craft CMS is a trademark of Pixel & Tonic; Okta, Microsoft Entra ID and Keycloak are trademarks of their respective owners. Keyway SSO is not affiliated with or endorsed by any of them.