RO Single Sign On
Setting up a site as both an Identity Provider and a Service Provider
This describes how to configure a single Joomla install running RO Single Sign On so that it acts as both a SAML Identity Provider (IdP) and a Service Provider (SP) - i.e. it authenticates its own users directly, but every login (including its own front-end/admin login) goes through the SAML flow. This is also the setup used to test an IdP without needing a second site: the SP trusts itself as the IdP ("self-loop").
Multi-factor authentication (MFA) and single sign-on
This explains what happens with multi-factor authentication (MFA) - the "enter a code from your authenticator app", security key, or backup code step Joomla can require after a password - when a site logs users in through RO SSO.
Bypass Multi-factor Authentication on Single Sign On Login
The Identity Provider should take care of all login features such as password, TOTP, Passkey or any other authentication option. The Service Provider takes care of the authorization.
Installation steps for RO Single Sign On
There are several installation steps for RO Single Sign On to be completed to install and configure the extension.
- Install the pkg_ro_sso.zip
- Enable plugin Authentication - RO Single Sign In
- Create a symlink named sso to the folder libraries/simplesamlphp/public/ to prevent access from the web to this folder ln -sfn libraries/simplesamlphp/public sso
- Go to Components -> RO Single Sign On -> Configuration
- Set the basepath to sso/
- Fill in all other relevant details
- Click Save
- Go to Certificates
- Create your certificates
- Go to Identity Provider Profiles
- Click New
- Fill in all the fields
- Click Save & Close
- Setup the Identity Provider if needed
- Setup the Service Provider if needed
- Setup cron job to renew metadata information
php /path/to/site/libraries/simplesamlphp/modules/metarefresh/bin/metarefresh.php METADATA URL
Exception: Unable to validate Signature
The error Exception: Unable to validate Signature means that the certificate data has changed.
The Identity Provider metadata must be refreshed to load the new certificate details.