Disconnect

It is possible to disconnect from a provider. This can be done using the {exp:reinos_sso:linked_providers} tag, where you use the {provider_disconnect_link} variable. This action will remove the reference from the Social Sign On table. The user will NOT lose their account; it will only remove the reference to the provider.

However, this can be problematic since users often do not know their password. There is an option in the Control Panel, Send new password via email, which sends a new password the first time a user logs in. However, users may still forget this.

To better control this process, we have introduced a new setting: Send password when user disconnects in the Control Panel of the SSO module. When enabled, this setting will send an email to the user with a new password after they disconnect from the provider.

CSRF token

Available from v6.0.0 (Breaking change)

A disconnect link must contain the CSRF token of the session, otherwise it is refused with the invalid_disconnect_link error. This prevents other websites from disconnecting a provider (and resetting the password) of your members. {provider_disconnect_link} contains the token already. When you build the link yourself, add &csrf_token={csrf_token}.

Links of versions before 6.0.0

Deprecated from v6.0.0

Before v6.0.0 the login and disconnect links used one action, act_route, with a method param ({reinos_sso_action_url}&method=disconnect&provider=...). From v6.0.0 {provider_link}, {provider_connect_link} and {provider_disconnect_link} use their own auth and disconnect actions.

Links you built yourself with {reinos_sso_action_url} (or a fixed ACT= id) and &method=auth or &method=disconnect keep working: act_route passes them on to the new actions, the CSRF token is still required for a disconnect. This is kept for backwards compatibility and will be removed in a future major version, so use the variables of {exp:reinos_sso:linked_providers} and {exp:reinos_sso:login_links} instead.