Login Settings

This tab lets you fine-tune how users are authenticated, how accounts are created, and how admin access is handled when using SAML SSO with your Joomla site.

1. Account Creation Settings

a) Domain Mapping

• Map specific email domains to a particular Identity Provider (IdP) so that when a user tries to log in with an email from that domain, they are automatically redirected to the correct IdP for authentication — useful if your site serves multiple organizations, each with their own IdP.
• Select the IdP from the dropdown and enter one or more comma-separated domains (e.g. miniorange) that should map to it. Multiple domain mapping rules can be added and removed as needed.

b) Login/Create Joomla Account By Email/Username

• Controls whether new Joomla accounts (and subsequent logins) are matched/created using the user's email or their username as the unique identifier.
• Choose "Email" if your IdP sends email as the primary identifying attribute, or "Username" if you'd rather match on a separate username attribute instead.

c) Do Not Auto Create Users

• When enabled, the plugin will not automatically create a new Joomla account for users authenticating via SSO for the first time.
• Only users who already have an existing Joomla account will be allowed to log in via SSO — anyone else attempting SSO login without a pre-existing account will be blocked. Useful for tightly controlling who can access the site, rather than letting anyone with valid IdP credentials self-provision an account.

2. Auto Redirect & Admin Access

a) Auto Redirect to IDP

• When enabled, any visitor accessing a frontend page of the site will be automatically redirected to the configured IdP's login page, rather than seeing the normal Joomla login form.
• Effectively enforces SSO-only login for the frontend — useful for internal or private sites where you don't want a local login option shown at all.

b) Enable SSO for /administrator URL

• Extends SSO enforcement to the Joomla admin/backend login page (/administrator), for one or more selected user groups: Administrator and Super Users, Manager, Child groups of Administrator and Super Users, and Child groups of Manager.
• You must also enter the URL of your site where the configured IdP's login links exist, so the plugin knows where to route admin users for authentication.
• This means admins in the selected groups will be required to authenticate via the IdP even to reach the backend, instead of using the standard Joomla admin login form.

c) Backdoor URL

• Since enabling SSO for the admin login page could lock you out if your IdP becomes unavailable or misconfigured, this provides a fallback login URL that bypasses SSO and lets you log in directly with your Joomla credentials.
• The URL follows the format https://<your-site>/administrator?mopassadminsso=true and can be copied directly from the field. Keep this URL safe and private — anyone with it can bypass SSO entirely for admin login.

3. Domain Mapping & Shared Session

a) Login Flow if Domain Mapping fails

• Defines the fallback behavior when a user's email domain doesn't match any of the configured Domain Mapping rules from section 1.
• For example, selecting "Allow User to login with their Joomla Credentials" lets unmatched users fall back to standard Joomla login rather than being blocked outright.

b) Ignore Special Characters From The Email For Register/Login

• When enabled, allows users whose email addresses contain special characters to still register or log in successfully, rather than being rejected due to character validation issues.

c) Enable Shared Session

• Enables a shared SSO session so that once a user authenticates, that session can be recognized across multiple applications/sites tied to the same IdP, avoiding the need to log in separately to each one.