Integration with OpenID Connect provider (SSO). Authorization

What this solution does

This module enables integration with any OpenID Connect provider to implement single sign-on (SSO) in Bitrix using credentials from external authentication systems. It is suitable for organizations of any scale building corporate portals, as well as for automatically creating and disabling users based on external authentication status. The functionality is available in all Bitrix editions, eliminating the need to purchase a higher edition solely for SSO and preventing the proliferation of user accounts.

Supported providers:

Any provider compatible with the OpenID Connect standard.

Tested with Keycloak (corporate authentication server) and multifactor.ru.

Key features:

Universal compatibility with any OpenID Connect provider.

Flexible configuration: ability to map user fields for each specific provider.

Optional automatic user creation upon first login.

Security: protection against CSRF attacks and token validation.

Debugging: detailed logs for issue diagnostics.

Compatibility: full operation with any Bitrix edition.

This module is logically incompatible with the standard Bitrix authorization component. Using both simultaneously will trigger attempts to authenticate using local credentials that do not reflect the current state of the provider.

Network connectivity to the OpenID Connect provider is required for every authorization attempt.

Full user list synchronization is not performed. The system operates on a just-in-time basis: a user is added to Bitrix only upon their first successful authorization, with data verification occurring individually for each request.

Role configuration is handled using standard Bitrix tools.

If a user is deleted, disabled, or blocked in the provider system, their record remains in Bitrix, but they will be unable to log in.

Workflow logic:

Authorization check: If the user is already authenticated, their information is displayed.

Redirection: If not authenticated, the user is redirected to the provider's login page.

Callback handling: Upon successful login, the provider returns an authorization code.

Token exchange: The code is exchanged for an access token.

User data retrieval: User information is fetched using the access token.

Bitrix search: The system searches for a matching user by exact login or email address.

The module provides integration with an OpenID Connect provider for single sign-on (SSO). During login, the system checks for an existing user: if the account is found, automatic authorization occurs; if not, a new record is created (provided this option is enabled).

General iT can install and configure this module and check how it works on your website.