README

This plugin adds a "G" button to the Craft Admin login. This simplifies logging in to any CMS set up by Glue-Agency. Works for Local and Remote environments using the Glue Google OAuth proxy (oauth.glue.be).

Requirements

This plugin requires Craft CMS 5.0.0 or later, and PHP 8.2 or later.

Installation

With Composer

Open your terminal and run the following commands

# Require the plugin through composer
composer require glue-agency/craft-glue-auth

# Install the plugin
php craft plugin/install glue-auth

Register the site with the proxy

The proxy only sends a login back to a callback it knows. Add https://<host>/glue-auth/auth/callback to the site's install at https://oauth.glue.be/admin/installs for every host the control panel is reached on: production, staging, each multisite host and every local URL. Matching is exact.

No secret or env var is needed. Sites upgrading from before 5.1.0 can drop GLUE_AUTH_ENCRYPTION_TOKEN and the encryptionToken config.

Configuration

Every setting has a default, so a config file is optional. To override one, create config/glue-auth.php:

<?php

return [
    'createUsers' => false,
];

• enabled (default true): show the "G" button, and disable regular login for Glue admin users. false turns both off.
• createUsers (default true): allow the plugin to create a new user, as an admin, when a Glue account without a user signs in. Set it to false to refuse an account the site has no user for. A user made by hand still signs in: it is matched on its email the first time, and bound to that Google account from then on.
• hostedDomain (default 'glue.be'): the Google Workspace domain an account must belong to. It also decides who counts as a Glue user.
• proxyUrl (default 'https://oauth.glue.be'): the OAuth proxy the login goes through.
• googleClientId (default: Glue's client id): the Google OAuth client the proxy signs in with.

Usage

• The CP login page and the session-expired modal get a "G" button that signs in with a Glue Google account.
• Regular (password) login is disabled for Glue admin users; they sign in with the "G" button.
• Utilities → Glue Auth lists the login history.
• Errors are written to their own glue-auth log in storage/logs/.