One foundation for SSO, passkey & more
Business customers want to sign in with their company login; consumers increasingly want to go passwordless with a passkey. Each of these methods needs the same foundation: find or create the user, establish the session, store credentials securely. The Authentication Framework provides this foundation once, so every method builds on it instead of rebuilding it.
What this OPAL does for you
1.Provides a fixed interface for sign-in methods: SSO, passkey and your own methods plug in without changing your store.
2.Stores provider credentials encrypted, with the key outside the database – and kept separate for each store.
3.Handles user creation, account linking, admin sign-in, sign-out and sessions – centrally for all methods.
Part of the OPAL family
OPALs are building blocks from OXID eSales: a proven foundation that is adapted to your IT landscape and integrated into your store.
Features at a glance
OXID
<OPAL/>
Provider interface & registry
Sign-in methods implement AuthenticationProviderInterface (initiation, callback, login options) and register via the DI service tag opal.authentication_provider. The ProviderRegistry detects active providers automatically and filters them by context (storefront / admin area).
Encrypted credential storage
Provider data is stored encrypted with AES-256-GCM; the key is derived via HKDF-SHA256 from sConfigKey in config.inc.php – outside the database. Data exfiltrated from the database alone therefore remains unreadable.
User provisioning & account linking
User lookup by email or subject claim, optional auto-create on first login, update-on-login from provider claims, and an account linking area where customers link and unlink external identities themselves.
Security in one place
The framework protects the sign-in process against manipulated redirects and forged requests and shows customers clear, understandable messages. Security-critical logic thus lives in one place instead of being reimplemented in every method.
Multishop isolation
Credentials are stored separately for each store. In mall setups, a setting lets you share them across stores – this requires OXID Enterprise Edition with mall sharing enabled.
Admin SSO & single logout
HMAC-signed one-time tokens (60-second window, replay prevention) for a seamless switch to the admin area after SSO login. Single logout coordinates sign-out between the store and the identity provider.
Who is this OPAL for?
Store owner / e-commerce manager (B2B / SSO)
Your customers should be able to sign in via their corporate identity provider (Keycloak, Microsoft Entra ID/Azure AD) or passwordless via passkey – and you want to configure the sign-in infrastructure for all of this in one place.
How it helps
The framework provides the interface, encrypted credential storage, user creation and session handling centrally. You manage automatic user creation, data sync on login and sharing across multiple stores in one place – not per method.
Frequently asked questions
Price
€5/month
OPALs are also available in subscription packages.