Magento 2 Identity Suite: Admin SSO, SCIM 2.0, Passkeys

In Magento Open Source, admin users are local accounts: separate passwords, separate 2FA, and nothing removes an admin when the person leaves the company's identity provider. The storefront has no built-in OIDC or passkey login either.

Free, open-source (OSL-3.0) Magento 2 modules on Packagist under dmlab/*, for Magento 2.4.9 and PHP 8.3–8.5, with unit tests and CI:

Admin SSO over OIDC: a provider-agnostic core with Okta, Microsoft Entra ID and Google Workspace plugins

Admin SCIM: an RFC 7643/7644 SCIM 2.0 provisioning server for admin users, with Okta and Google plugins

Customer SSO over OIDC for the storefront, with IdP group to customer group mapping

Passkey (WebAuthn) passwordless storefront login

OIDC flow with state, nonce and PKCE, plus the RFC 9207 issuer check on the callback. Admins are matched by issuer + subject; email fallback only when email_verified is true

IdP group to admin role mapping, first match wins, then a default role or a refused login. Enforced SSO covers both the admin form and the REST token endpoint, with a break-glass username list

Magento 2FA is skipped only when the ID token carries MFA evidence (amr/acr) and that option is turned on

SCIM Users and Groups with filters, PATCH and .search. PATCH active=false ends the admin's sessions and revokes API tokens. The bearer token is stored encrypted and compared in constant time, with failed-auth throttling

SCIM only touches admins it created, and refuses any change that would leave no active admin with a role. Per-IdP request quirks live in provider plugins, not in the core

Passkeys: single-use challenges bound to the ceremony, a sign-counter check that flags cloned authenticators, admin revocation for lost devices, Luma and Hyvä templates