Add hosted sign-in and account switching to a PHP page

By The Grim Scalper · Tags: blog , security , identity

A builder and a friendly robot arrange three illustrated cards along one amber connector on a sunlit worktable.

A small PHP page can offer sign-in beside its account display without moving its authentication logic into the page. Let’s build one around hosted sign-in in an iframe, followed by an automatic page reload.

One hosted sign-in, several presentations explains the presentation choices. Here we’ll follow one concrete path from the hosted sign-in guide, keeping the ordinary full-page link available throughout.

1. Start with the matching packages

Use Web/PHP 0.1.5 and the separate M7 Identity Active Tags 0.1.1. These exact downloads have been retrieved and checked against their SHA-256 sidecars and file manifests. Web/PHP 0.1.4 lacks the background-completion APIs this example needs.

The Identity package supplies its modal and trigger assets. Add your consumer page’s general Active Tags runtime, ui.dialog and ui.tabs services, and general dialog, tab, backdrop and type styles separately. The Identity package bundles neither those dependencies nor another OAuth implementation.

2. Prepare the server and registration

Follow the Web/PHP installation guide to configure the confidential client in the trusted PHP worker environment. Match the registered HTTPS origin and /m7_sso_session/callback exactly, including the selected authentication, token, acknowledgement and proof settings. Keep secrets and the pending-envelope key out of HTML and the public directory.

Copy the Web package’s m7_sso_session/ into public_html/m7_sso_session/. Preserve the ordinary full-page callback with query response mode.

For embedding, the registration must support web_message.parent, and SSO must permit framing by your exact application origin. Your content security policy must allow the intended frame and callback. Web Message cannot carry encrypted JARM: an incompatible authorization-response encryption policy fails closed, without downgrading. Choose an eligible configuration. Browser storage restrictions still apply.

3. Deploy the complete example

From the Active Tags package, copy dist/nomap/m7-identity/ to public_html/vendor/m7-identity/. Copy the matching dist/nomap/examples/flow.php to public_html/embedded-sign-in/flow.php, and include the matching examples/include.php once in your page shell.

That include supplies one shared modal and configures automatic reload after success. Its same-origin POST adapter connects start/cancel actions to m7_start_authorization() and m7_cancel_authorization(). Keep that adapter with the example; the trigger markup alone cannot complete the journey.

Use the full example supplied in the archive, with the sign-in guide beside it.

4. Keep a real sign-in link

This exact emitted anchor was checked against the maintained source, local build and PHP syntax. It requires the setup above; it is not a standalone runnable page.

<a href="/m7_sso_session/?fast_switch=1"
  data-activetag at-name="identity-sign-in"
  at-at="import:/vendor/m7-identity/js/sign-in-trigger.js?v=0.1.1-ca23932bdf86"
  data-identity-method="iframe" aria-haspopup="dialog" aria-controls="embedded-sign-in">Login</a>

Render Login when your app has no session and Switch account when it does. Your app owns that label and account display. fast_switch=1 skips the local handoff template and redirects to authorization; it does not itself request an account chooser. Switching is not logout.

The ordinary href remains useful before initialization or when required dependencies are unavailable. Preserve it as the native full-page route.

5. Refresh the account area after completion

An iframe loading does not establish a session. The SDK checks the response’s origin, sender window, issuer, state and pending transaction, then completes through a hidden same-origin callback iframe, including token pickup, cookies and acknowledgement activation.

The example reloads after validated session installation. Your page then renders its existing session-dependent account or avatar display again. The package does not automatically fetch and paint a profile or provide a new public completion-event API.

This flow uses hosted sign-in. Tenant-only browser-direct authentication has separate APIs and does not belong in this example.

6. Rebuild only when you change the sources

The ZIP already includes deployable assets. For customization, the maintained build uses Node 20 or newer. From the Active Tags package root, its readable entry points are:

node scripts/build.mjs
node scripts/build.mjs --with-map

Both builds and the emitted PHP examples’ syntax checks passed in local validation, using an existing build dependency. No installation or live login was exercised. Deploy the complete output and matching examples together; a rebuild can change the versioned import.

Before using your integration, test iframe sign-in, cancellation/retry, account switching, the refreshed label and full-page fallback through a non-production registration in your supported browsers. Frame permission cannot override blocked cross-site storage. An SSO-root require_dpop=true preference also directs consumer iframe sign-in to full-page; that preference is separate from your client’s token DPoP policy. Keep that dependable full-page journey within reach.