Blackbit's Single Sign-On Bundle is compatible with the Pimcore Studio UI starting with version 2. User management and login remain where they belong: with the central authentication provider.
Central User Management Is the Starting Point
Companies rarely manage their user administration in isolation. Microsoft Active Directory, an enterprise-wide SAML federation, or a central LDAP server are the standard in established IT landscapes – and the starting point from which Pimcore must be integrated. Although Pimcore offers its own SSO functionality based on OpenID Connect, this requires an Enterprise subscription and does not support LDAP or SAML.
The Blackbit SSO Bundle fills this gap: It supports all three protocols and is available for installations starting with Pimcore 10 – regardless of the license type. Those who manage multiple user groups with different providers – such as an internal team via Active Directory and an external agency via a separate OpenID provider – can operate both in parallel.
Version 2 Introduces the Studio UI
A new feature is support for the Studio UI; the classic interface is still supported. The feature set is the same in both interfaces. The bundle has been tested with Pimcore 10 and later; older versions have not been tested. The Studio UI is available starting with Pimcore 12.
What the Bundle Does
The bundle brings single sign-on to the Pimcore backend and to Pimcore-based websites. Login credentials and role assignment are managed by the external authentication provider, not in Pimcore. This has practical implications. Pimcore accounts no longer need to be created manually. If someone leaves the company, the administration can lock all logins in one place. And users only need to remember one password instead of many.
Supported Providers
The bundle supports OpenID Connect, SAML, and LDAP. OpenID Connect allows integration with Microsoft Entra ID (formerly Azure Active Directory), Auth0, Google, Okta, and Keycloak, among others. The bundle includes detailed instructions on how to set up the application with the provider and where to enter the necessary keys in Pimcore.
Multiple providers can be used simultaneously. This is helpful when internal teams use a different provider than, for example, an external agency. For providers using OpenID Connect or SAML, a separate button appears on the login page. LDAP, on the other hand, uses the standard login form and verifies the entered credentials against the LDAP server.
Here's How the Login Works
Clicking the SSO button redirects you to the authentication provider. After logging in there, you're redirected back to Pimcore, already logged in. In the background, a regular Pimcore user account is created using the provider's data, such as the username and email address. All Pimcore features work with this account just as they would with a manually created one.
You can set a provider as the default. When you access the Pimcore backend, you'll be taken directly to that provider's login page.
Automatically Map Roles and Fields
The provider's fields can be mapped to the Pimcore user account. This ensures, for example, that the email address remains up to date. Groups from the authentication system can be assigned as Pimcore roles if desired. If a role does not yet exist, the bundle creates it, initially without permissions.
In addition, there are default roles for each provider. These apply only to newly created users, not to existing accounts.
Extensible via Events and Twig
After every successful login, the bundle triggers the sso.logged-in event. It provides the Pimcore user, all data from the provider, and the name of the provider used. Custom logic can be integrated here.
Login buttons are available as Twig code for websites. Output is available as HTML or JSON, and the template can be overridden. After login, the bundle redirects to a URL of your choice or back to the page that was accessed. An included trait handles login validation and logout within your own controller.
Setup in the Studio UI
When upgrading from Version 1, configuration is key. In the Studio UI, this is located under Settings > System > Users & Roles > Single Sign-On. For the login to work via the Studio UI, the file config/packages/security.yaml requires an additional access rule. All steps are described in the configuration guide for the Studio UI on GitHub.
Already Using the Bundle?
Customers with active Bitbucket access can download Version 2 directly.
New to the Bundle?
The bundle is available in the Pimcore Store as well as directly from us in the Blackbit Shop.
If you have questions about configuration or the licensing model: help@blackbit.de
