Disconnect

It is possible to disconnect from a provider. This can be done using the {exp:reinos_sso:linked_providers} tag, where you use the {provider_disconnect_link} variable. This action will remove the reference from the Social Sign On table. The user will NOT lose their account; it will only remove the reference to the provider.

However, this can be problematic since users often do not know their password. There is an option in the Control Panel, Send new password per mail, which sends the generated password to a member that is created by a social login. However, users may still forget this.

To better control this process, we have introduced a new setting: Send password when user disconnect in the Control Panel of the SSO module. When enabled, the member gets a new random password after they disconnect from the provider (it replaces their current password), and an email with that password (the Social account disconnect email template, see CP Overview).

When nobody is logged in, or the provider is not connected to the member, the disconnect link does nothing and the visitor goes to the return URL.

CSRF token

Available from v6.0.0 (Breaking change)

A disconnect link must contain the CSRF token of the session, otherwise it is refused with the invalid_disconnect_link error. {provider_disconnect_link} contains the token already. When you build the link yourself, add &csrf_token={csrf_token}.

Build the link yourself

Available from v6.0.0

The global variable {reinos_sso_disconnect_url} contains the URL of the disconnect action. Add the provider, the CSRF token and optionally the return URL:

<a href="{reinos_sso_disconnect_url}&provider=Google&csrf_token={csrf_token}&return=/members">Disconnect Google</a>

The login link has its own global, {reinos_sso_auth_url}, with the params provider, action (login or connect), return and new_member_return:

<a href="{reinos_sso_auth_url}&provider=Google&action=login&return=/members">Log in with Google</a>

Links of versions before 6.0.0

Deprecated from v6.0.0

Before v6.0.0 the login and disconnect links used one action, act_route, with a method param ({reinos_sso_action_url}&method=disconnect&provider=...). From v6.0.0 {provider_link}, {provider_connect_link} and {provider_disconnect_link} use their own auth and disconnect actions.

Links you built yourself with {reinos_sso_action_url} (or a fixed ACT= id) and &method=auth or &method=disconnect keep working: act_route passes them on to the new actions, the CSRF token is still required for a disconnect. This is kept for backwards compatibility and will be removed in a future major version, so use the variables of {exp:reinos_sso:linked_providers} and {exp:reinos_sso:login_links}, or the {reinos_sso_disconnect_url} and {reinos_sso_auth_url} globals (see above) instead.