One foundation for SSO, passkey & more
Business customers want to sign in with their company login, end customers increasingly without a password via passkey. Each of these methods needs the same foundation: find or create the user, establish the session, store credentials securely. The Authentication Framework provides this foundation once, so the methods build on it instead of rebuilding it each time.
What the OPAL solves for you
1.Provides a fixed interface for sign-in methods: SSO, passkey and your own methods plug in without changing your store.
2.Stores provider credentials encrypted, with the key outside the database – and kept separate per shop.
3.Handles user creation, account linking, admin sign-in, sign-out and session – centrally for all methods.
Before / After
SSO or passkey would have to be built from scratch, including the connection to the store.
A fixed interface carries SSO, passkey and future methods on one shared flow.
Every sign-in method would build its own session, user creation and encryption – double the effort, inconsistent behavior.
The framework handles user lookup, creation, encryption and session – one place to configure all methods.
Provider credentials would have to be encrypted and managed on your own.
Credentials are encrypted with AES-256-GCM, the key is kept outside the database, and the data is separated per shop.
Part of the OPAL family
OPALs are building blocks from OXID eSales: a proven, solid foundation that needs to be adapted to your system landscape and integrated into your store.
Features at a glance
OXID
<OPAL/>
Provider interface & registry
Sign-in methods implement AuthenticationProviderInterface (initiation, callback, login options) and register via the DI service tag opal.authentication_provider. The ProviderRegistry detects active providers automatically and filters them by context (frontend / backend).
Encrypted credential storage
Provider data is stored encrypted with AES-256-GCM; the key is derived via HKDF-SHA256 from sConfigKey in config.inc.php – outside the database. A database exfiltration alone therefore remains unreadable.
User provisioning & account linking
User lookup by email or subject claim, optional auto-create on first login, update-on-login from provider claims, and an account linking area where customers link and unlink external identities themselves.
Security in one place
The framework includes protection of the sign-in process against manipulated redirects and forged requests, as well as clear messages for the customer. Security-critical logic thus lives in one place instead of being repeated in every method.
Multi-shop isolation
Credentials are stored separately per shop. For mall operation, a setting lets you use them across shops – this requires the Enterprise Edition with mall sharing enabled.
Admin SSO & single logout
HMAC-signed one-time tokens (5-minute window, replay prevention) for a seamless switch to the backend after SSO login. Single logout coordinates sign-out between the store and the identity provider.
Who is the OPAL for?
Shop operator / e-commerce manager (B2B / SSO)
Your customers should sign in via corporate identity (Keycloak, Azure AD) or password-free via passkey – and you want to configure the same sign-in infrastructure in one place.
What the OPAL delivers here
The framework centrally provides the interface, encrypted credential storage, user creation and session. You maintain automatic user creation, data sync on login and shared use across multiple shops in one place – not per method.
Frequently asked questions
Price
€5/month
OPALs are also available in subscription packages.