Overview

OAuth SSO solves the login problem; users authenticate through their identity provider and land in Joomla without needing a separate account. But SSO on its own only updates user data at the moment of login. If someone's name, email address, or department changes in the identity provider between sessions, that change does not make it to Joomla until they log in again. And it never makes it to Joomla at all if the user has not logged in recently.

The miniOrange User Sync extension works alongside the miniOrange Joomla OAuth Client extension to keep user data consistent between your identity provider and Joomla on an ongoing basis. The OAuth extension handles authentication. The User Sync extension handles the data. Together, they make sure that what the identity provider holds about each user and what Joomla holds stay in agreement, whether that sync happens at login, on a schedule, or manually when needed.

Prerequisites

To enable Bidirectional User Data Synchronization with OAuth SSO on a Joomla website, you will need the following:

miniOrange OAuth Client Extension for Joomla

Download Extension

miniOrange User Sync Extension for Joomla

Download Extension

Challenge

Running OAuth SSO without a sync layer in place creates data consistency problems that grow quietly in the background:

• User profiles go stale. People change their names, email addresses get updated when companies restructure, and job titles change. Without sync, Joomla holds whatever data was captured when the account was first created. The identity provider and Joomla drift apart, and neither record can be fully trusted.
• Every update has to be done twice. If there is no automated sync, any change in the identity provider has to be manually replicated in Joomla, and vice versa. For a large user base, this is a constant drain on administrator time with no good way to enforce consistency.
• New users do not exist in Joomla until they log in. If someone's account is created in the identity provider before they have ever visited the Joomla site, Joomla has no record of them at all. This causes problems in workflows that expect user records to exist before first access.
• Former users keep their Joomla accounts. When someone leaves an organization or a subscription ends, their identity provider account is typically disabled or deleted. Without a sync process to carry that change over to Joomla, their Joomla account stays active, and their access remains intact.

Implementation

The setup connects the two miniOrange extensions and configures how user data flows between the identity provider and Joomla.

1. Setting Up the OAuth SSO Connection: Configure the miniOrange OAuth Client extension with your identity provider's credentials and endpoints using the standard OAuth 2.0 or OIDC setup. Enable the scopes that return full user profile information, since this is the data channel the User Sync extension will also use. This step is the same as any standard SSO setup.

2. Installing and Linking the User Sync Extension: Install the miniOrange User Sync extension and connect it to the same identity provider configuration used by the OAuth extension. The two extensions share the same authenticated connection, so no separate authentication setup is needed for the sync process.

3. Mapping User Attributes: In the attribute mapping settings, specify which identity provider fields should map to which Joomla user profile fields. Standard fields like first name, last name, and email address map directly. If your Joomla site uses custom profile fields, those can be mapped to corresponding custom claims in the identity provider. For each mapped field, you can also control direction: whether the identity provider's value overwrites Joomla's, whether Joomla pushes values back to the identity provider, or whether both directions are active.

4. Choosing How Sync is Triggered: The extension gives you three options for when sync runs. Login-triggered sync updates the user's Joomla profile with the latest identity provider data every time they log in via SSO, with no separate process required. Scheduled sync runs in the background at a set interval, such as hourly or daily, and processes the full user base even for users who have not logged in recently. Manual sync lets an administrator kick off a sync run from the extension dashboard, which is useful for applying a large batch of changes immediately or verifying that the configuration is working before automating it.

5. Configuring Provisioning and Deprovisioning: The User Sync extension can automatically create Joomla accounts for users who exist in the identity provider but have not yet visited the site. This ensures Joomla records are ready before a user's first login. Conversely, when an identity provider account is disabled or deleted, the extension can be configured to disable or remove the corresponding Joomla account, so former users do not retain active access.

6. Testing the Configuration: Before enabling automated sync on a live site, test the setup by updating a test user's attributes in the identity provider and triggering a sync to confirm the changes appear correctly in Joomla. If bidirectional sync is configured, make a change in Joomla and verify it propagates back to the identity provider. Test provisioning by creating a new identity provider account and confirming that a Joomla account is created. Test deprovisioning by disabling an identity provider account and confirming the Joomla account is handled as expected.

Conclusion

OAuth SSO takes care of authentication, but keeping user data accurate across your identity provider and Joomla requires something more. The miniOrange User Sync extension fills that gap by giving administrators control over when and how user data syncs, which fields are included, and what happens when accounts are created or removed. The result is a setup where your identity provider stays the authoritative source for user information, and Joomla stays in step with it automatically.

Additional Resources

1. Access Security via Compartmentalization - OAuth Protocol in Joomla!
2. SAML vs OAuth in Joomla: Which should you choose?
3. Check out our documentation