Skip to main content
Version: Next

Installation

info

OpenID Connect is an enterprise bundle. It requires a Pimcore enterprise subscription.

Prerequisites​

The bundle requires PHP 8.4 or 8.5 and Pimcore 2026.1 or later.

Composer pulls in the Studio Backend and Studio UI bundles, and the bundle registers the Enterprise Subscription Tools bundle as a dependent bundle. Registering a dependent bundle only loads it into the kernel, and pimcore:bundle:install does not cascade: install Studio Backend separately with bin/console pimcore:bundle:install PimcoreStudioBackendBundle, because its own installer creates the tables and user permissions Pimcore Studio needs.

Depending on the algorithm a provider uses to sign tokens, installing the bcmath or gmp PHP extension improves performance for RSA-based algorithms.

Bundle Installation​

  1. Install the package:
composer require pimcore/openid-connect
  1. Enable the bundle in config/bundles.php:
use Pimcore\Bundle\OpenIdConnectBundle\PimcoreOpenIdConnectBundle;
// ...

return [
    // ...
    PimcoreOpenIdConnectBundle::class => ['all' => true],
    // ...
];
  1. Install the bundle:
bin/console pimcore:bundle:install PimcoreOpenIdConnectBundle

The installer creates the permission_oidc_config user permission described below.

User Permissions​

Access to the OpenID Connect integration is controlled by a single permission:

  • OpenID Connect Configuration (permission_oidc_config). Grants access to the OpenId Connect Configuration and Debugging Tool entries under System > User & Roles > OpenId Connect in Pimcore Studio, and to the configuration and debug endpoints behind them. Users without this permission do not see the menu entries.

Grant it to every user or role that manages OpenID Connect providers. See Configuration for what the configuration screen and the debugging tool do.

Public Routes for the Login Flow​

Pimcore Studio's API firewall requires an authenticated session for every request under /pimcore-studio/api by default. The OAuth2 login flow runs before that session exists, so its callback, login and script routes must be publicly reachable. Add the following access_control rule to config/packages/security.yaml, before the catch-all Studio API rule:

security:
    access_control:
        # ... other rules, see the Studio Backend installation guide ...
        - { path: ^/pimcore-studio/api/bundle/openid-connect/auth/, roles: PUBLIC_ACCESS }
        - { path: ^/pimcore-studio/api, roles: ROLE_PIMCORE_USER }

Rules are evaluated in order and the first match wins, so the OpenID Connect rule must come before the catch-all ^/pimcore-studio/api rule. Otherwise the firewall rejects the unauthenticated request before the OAuth2 flow can complete. See the Studio Backend Bundle's baseline firewall setup for the rest of the access_control list this rule extends, and its prefix configuration if you changed /pimcore-studio/api to a custom path.

The bundle registers its authenticator (OpenIdConnectAuthenticator) into the Studio firewall automatically; no manual security.yaml firewall changes beyond the access_control rule above are required.

If another bundle adds its own firewall in front of Pimcore Studio, verify that its public-route configuration also excludes these OpenID Connect routes, or the OAuth2 callback never reaches Pimcore. For the Portal Engine, list the route names in custom_public_routes:

pimcore_portal_engine:
    custom_public_routes:
        - pimcore_studio_api_bundle_openid_connect_auth_endpoint
        - pimcore_studio_api_bundle_openid_connect_auth_login
        - pimcore_studio_api_bundle_openid_connect_auth_script