How it works

As already know the SSO module will allow users to login on your site via a social provider. Below a couple of cases how the module will handle the login and what it will do.

The Login process

1. The user clicks on of the social provider that are enabled provided by {exp:reinos_sso:login_links}
2. The user will redirect to the social provider and will be asked for his login.
3. When the user enters the correct credentials, the user will be redirect to the EE site
4. On the main EE site, the SSO module will check if the user exists.
5. If the social account is not linked to a member yet and there is no member with its email address:
   1. if the social provider did not give an email address, the user is asked for it with the Email collect form. This email address may not be in use by another member.
   2. if the setting "Allow new SSO accounts" is set to no, the only_existing_accounts_allowed error is shown.
   3. if the setting "Allow new SSO accounts" is set to yes:
      1. there will be a new member profile created for the user, with the role of the "Member role" setting. The email address is used as username and email, the name at the social provider as screen name.
      2. and a connect link will be made between the social provider and the EE site.
      3. the member gets the profile picture of the social provider (when you have an upload directory named Avatars), and the new password by email when "Send new password per mail" is on.
6. If the user exists
   1. if the setting "Allow social login to merge with non social accounts" is set to no, the email_already_registered error is shown. The user is not logged in.
   2. if the setting "Allow social login to merge with non social accounts" is set to yes the user will be logged in on the account that already exists on the EE site. When "Require a verified email to link an existing account" is on (default), this only happens when the provider verified the email address, otherwise the email_not_verified error is shown.
   3. if the user has an account, that is connected to a social provider, it will always login on the existing account.
7. Banned and pending members cannot log in, they get the account_banned or account_pending error.
8. After the login the user goes to the return URL, or to the new_member_return URL when the login created the member. When the login fails, the user goes to the return URL.

A user that is already logged in and uses a login link is sent to the homepage of your site.

Errors are shown with the error tags.

Connecting a provider

A logged in member can link more social accounts to their account with {exp:reinos_sso:linked_providers}. When the member is not logged in, the connect_requires_login error is shown. A social account can only be linked to one member: when it is already linked to another member, it is not connected and an error is shown.

A member can remove the link again, see Disconnect.

Return URLs

Available from v6.0.0

The return and new_member_return params must be a relative URL or a URL on the domain of your site. Other URLs are replaced by the site index. Allow extra domains in your config.php:

$config['reinos_sso_allowed_redirect_hosts'] = ['shop.example.com'];

Deleted members

When you delete or anonymize a member, the links with their social accounts are removed as well.

Zoo Visitor

When the Zoo Visitor add-on is installed, a new member that is created by a social login also gets a Visitor member entry, with the screen name as title. The entry gets the status that belongs to the role of the "Member role" setting; when that status does not exist, no entry is created and the SSO log shows an error.

Logout

To logout use the regular EE tag {path='logout'} as mentions on the ExpressionEngine documentation site. This logs the user out of your site, not out of the social site itself.