diff --git a/config/packages/security.yaml b/config/packages/security.yaml
index 980fb59f7ac..c9ec5a22dab 100644
--- a/config/packages/security.yaml
+++ b/config/packages/security.yaml
@@ -52,6 +52,9 @@ security:
                 authentication_required_handler: sulu_security.two_factor_authentication_required_handler
                 success_handler: sulu_security.two_factor_authentication_success_handler
                 failure_handler: sulu_security.two_factor_authentication_failure_handler
+            access_token:
+                token_handler: sulu_security.single_sign_on_token_handler
+                token_extractors: sulu_security.single_sign_on_token_extractor
 
 #        website:
 #            pattern: ^/
diff --git a/config/routes/sulu_admin.yaml b/config/routes/sulu_admin.yaml
index 0b19447d89f..d0ccf7e9b8d 100644
--- a/config/routes/sulu_admin.yaml
+++ b/config/routes/sulu_admin.yaml
@@ -113,3 +113,9 @@ sulu_audience_targeting_api:
     type: rest
     resource: "@SuluAudienceTargetingBundle/Resources/config/routing_api.yml"
     prefix: /admin/api
+
+sulu_admin_single_sign_on:
+    path: /openid
+    controller: Symfony\Bundle\FrameworkBundle\Controller\RedirectController::redirectAction
+    defaults:
+        route: sulu_admin
diff --git a/src/Sulu/Bundle/AdminBundle/Resources/js/components/Input/Input.js b/src/Sulu/Bundle/AdminBundle/Resources/js/components/Input/Input.js
index 5ef30ac2819..c551189d02b 100644
--- a/src/Sulu/Bundle/AdminBundle/Resources/js/components/Input/Input.js
+++ b/src/Sulu/Bundle/AdminBundle/Resources/js/components/Input/Input.js
@@ -19,6 +19,7 @@ export default class Input<T: ?string | ?number> extends React.PureComponent<Inp
         skin: 'default',
         type: 'text',
         valid: true,
+        autoFocus: false,
     };
 
     setInputRef = (ref: ?ElementRef<'input'>) => {
@@ -86,6 +87,7 @@ export default class Input<T: ?string | ?number> extends React.PureComponent<Inp
             min,
             max,
             step,
+            autoFocus,
         } = this.props;
 
         const inputContainerClass = classNames(
@@ -159,6 +161,7 @@ export default class Input<T: ?string | ?number> extends React.PureComponent<Inp
                         ref={inputRef ? this.setInputRef : undefined}
                         step={step}
                         type={type}
+                        autoFocus={autoFocus}
                         value={value == null ? '' : value}
                     />
 
diff --git a/src/Sulu/Bundle/AdminBundle/Resources/js/containers/Login/LoginForm.js b/src/Sulu/Bundle/AdminBundle/Resources/js/containers/Login/LoginForm.js
index eba77b9a23e..e2c076ffc63 100644
--- a/src/Sulu/Bundle/AdminBundle/Resources/js/containers/Login/LoginForm.js
+++ b/src/Sulu/Bundle/AdminBundle/Resources/js/containers/Login/LoginForm.js
@@ -119,7 +119,7 @@ class LoginForm extends React.Component<Props> {
                                 />
                             </label>
                         )}
-                        {!this.props.hasSingleSignOn || (this.props.hasSingleSignOn && this.props.hasOnlyPassword) && (
+                        {(!this.props.hasSingleSignOn || (this.props.hasSingleSignOn && this.props.hasOnlyPassword)) && (
                             <label className={inputFieldClass}>
                                 <div className={formStyles.labelText}>
                                     {translate('sulu_admin.password')}
@@ -131,22 +131,23 @@ class LoginForm extends React.Component<Props> {
                                     type="password"
                                     valid={!this.props.error}
                                     value={this.password}
+                                    autoFocus={this.props.hasOnlyPassword}
                                 />
                             </label>
                         )}
-                        <div className={formStyles.buttons}>
-                            <Button onClick={this.props.onChangeForm} skin="link">
-                                {translate('sulu_admin.forgot_password')}
-                            </Button>
-                            <Button
-                                disabled={this.submitButtonDisabled}
-                                loading={this.props.loading}
-                                skin="primary"
-                                type="submit"
-                            >
-                                {translate('sulu_admin.login')}
-                            </Button>
-                        </div>
+                            <div className={formStyles.buttons}>
+                                    <Button onClick={this.props.onChangeForm} skin="link">
+                                        {translate('sulu_admin.forgot_password')}
+                                    </Button>
+                                <Button
+                                    disabled={this.submitButtonDisabled}
+                                    loading={this.props.loading}
+                                    skin="primary"
+                                    type="submit"
+                                >
+                                    {translate('sulu_admin.login')}
+                                </Button>
+                            </div>
                     </fieldset>
                 </form>
             </Fragment>
diff --git a/src/Sulu/Bundle/AdminBundle/Resources/js/stores/userStore/userStore.js b/src/Sulu/Bundle/AdminBundle/Resources/js/stores/userStore/userStore.js
index 3e127bcafe9..4cb56407d26 100644
--- a/src/Sulu/Bundle/AdminBundle/Resources/js/stores/userStore/userStore.js
+++ b/src/Sulu/Bundle/AdminBundle/Resources/js/stores/userStore/userStore.js
@@ -197,7 +197,13 @@ class UserStore {
         this.setLoading(true);
 
         return Requester.post(Config.endpoints.forgotPasswordReset, data)
-            .then(() => {
+            .then((data) => {
+                if (data.method === 'redirect' && data.url) {
+                    window.location.href = data.url;
+
+                    return
+                }
+
                 this.setLoading(false);
                 this.setForgotPasswordSuccess(true);
             })
diff --git a/src/Sulu/Bundle/SecurityBundle/DependencyInjection/Configuration.php b/src/Sulu/Bundle/SecurityBundle/DependencyInjection/Configuration.php
index 7f6ea98b6b6..7047c554ac5 100644
--- a/src/Sulu/Bundle/SecurityBundle/DependencyInjection/Configuration.php
+++ b/src/Sulu/Bundle/SecurityBundle/DependencyInjection/Configuration.php
@@ -76,6 +76,9 @@ public function getConfigTreeBuilder(): TreeBuilder
                                     ->scalarNode('dsn')
                                         ->cannotBeEmpty()
                                     ->end()
+                                    ->scalarNode('user_role')
+                                        ->cannotBeEmpty()
+                                    ->end()
                                 ->end()
                             ->end()
                         ->end()
diff --git a/src/Sulu/Bundle/SecurityBundle/DependencyInjection/SuluSecurityExtension.php b/src/Sulu/Bundle/SecurityBundle/DependencyInjection/SuluSecurityExtension.php
index 5dc42955b5c..1402c7def01 100644
--- a/src/Sulu/Bundle/SecurityBundle/DependencyInjection/SuluSecurityExtension.php
+++ b/src/Sulu/Bundle/SecurityBundle/DependencyInjection/SuluSecurityExtension.php
@@ -1,5 +1,7 @@
 <?php
 
+declare(strict_types=1);
+
 /*
  * This file is part of Sulu.
  *
@@ -76,7 +78,7 @@ public function load(array $configs, ContainerBuilder $container)
         /** @var array<string, class-string> $bundles */
         $bundles = $container->getParameter('kernel.bundles');
 
-        if (\in_array(SchebTwoFactorBundle::class, $bundles)) {
+        if (\in_array(SchebTwoFactorBundle::class, $bundles, true)) {
             $loader->load('2fa.xml');
 
             if (\interface_exists(AuthCodeMailerInterface::class)) {
@@ -103,18 +105,27 @@ public function load(array $configs, ContainerBuilder $container)
                 RoleRepositoryInterface::class => 'sulu.repository.role',
                 RoleSettingRepositoryInterface::class => 'sulu.repository.role_setting',
                 AccessControlRepositoryInterface::class => 'sulu.repository.access_control',
-            ]
+            ],
         );
 
+        $singleSignOnMapping = [];
+
         $container->setParameter('sulu_security.has_single_sign_on_providers', false);
 
-        if (array_key_exists('single_sign_on', $config)
-            && array_key_exists('providers', $config['single_sign_on'])) {
+        if (\array_key_exists('single_sign_on', $config)
+            && \array_key_exists('providers', $config['single_sign_on'])) {
             $container->setParameter(
                 'sulu_security.has_single_sign_on_providers',
-                \count($config['single_sign_on']['providers']) > 0
+                \count($config['single_sign_on']['providers']) > 0,
             );
+
+            foreach ($config['single_sign_on']['providers'] as $domain => $provider) {
+                $singleSignOnMapping[$domain]['dsn'] = $provider['dsn'];
+                $singleSignOnMapping[$domain]['user_role'] = $provider['user_role'] ?? null;
+            }
         }
+
+        $container->setParameter('sulu_security.single_sign_on_mapping', $singleSignOnMapping);
     }
 
     /**
@@ -130,7 +141,7 @@ public function prepend(ContainerBuilder $container)
                         'enabled' => false,
                         'mailer' => 'sulu_security.two_factor_mailer',
                     ],
-                ]
+                ],
             );
         }
 
@@ -146,7 +157,7 @@ public function prepend(ContainerBuilder $container)
                             EmailNotUniqueException::class => 409,
                         ],
                     ],
-                ]
+                ],
             );
         }
 
@@ -163,7 +174,7 @@ public function prepend(ContainerBuilder $container)
                     'fragments' => [
                         'path' => '/admin/_fragments',
                     ],
-                ]
+                ],
             );
         }
 
@@ -205,7 +216,7 @@ public function prepend(ContainerBuilder $container)
                             ],
                         ],
                     ],
-                ]
+                ],
             );
         }
     }
diff --git a/src/Sulu/Bundle/SecurityBundle/Resources/config/services.xml b/src/Sulu/Bundle/SecurityBundle/Resources/config/services.xml
index fb1041b8fff..984f1aed5e1 100644
--- a/src/Sulu/Bundle/SecurityBundle/Resources/config/services.xml
+++ b/src/Sulu/Bundle/SecurityBundle/Resources/config/services.xml
@@ -386,8 +386,40 @@
             <tag name="sulu_admin.form_metadata_visitor" />
         </service>
 
-        <service id="sulu_security.open_id_login_subscriber" class="Sulu\Bundle\SecurityBundle\Security\OpenIdLoginSubscriber">
+        <service id="sulu_security.open_id_login_subscriber" class="Sulu\Bundle\SecurityBundle\SingleSignOn\SingleSignOnLoginRequestSubscriber">
+            <argument type="service" id="sulu_security.single_sign_provider"/>
+            <argument type="service" id="router"/>
+            <argument type="service" id="sulu.repository.user"/>
             <tag name="kernel.event_subscriber"/>
         </service>
+
+        <service id="sulu_security.single_sign_on_adapter_factory_open_id" class="Sulu\Bundle\SecurityBundle\SingleSignOn\Adapter\OpenId\OpenIdSingleSignOnAdapterFactory">
+            <argument type="service" id="http_client"/>
+            <argument type="service" id="sulu_security.user_repository"/>
+            <argument type="service" id="doctrine.orm.entity_manager"/>
+            <argument type="service" id="sulu.repository.contact"/>
+            <argument type="service" id="sulu.repository.role"/>
+            <argument type="service" id="router"/>
+
+            <tag name="sulu_security.single_sign_on_factory"/>
+        </service>
+
+        <service id="sulu_security.single_sign_on_adapter_factory" class="Sulu\Bundle\SecurityBundle\SingleSignOn\SingleSignOnAdapterFactory">
+            <argument type="tagged_iterator" tag="sulu_security.single_sign_on_factory"/>
+        </service>
+
+        <service id="sulu_security.single_sign_provider" class="Sulu\Bundle\SecurityBundle\SingleSignOn\SingleSignOnAdapterProvider">
+            <argument type="service" id="sulu_security.single_sign_on_adapter_factory"/>
+            <argument>%sulu_security.single_sign_on_mapping%</argument>
+        </service>
+
+        <service id="sulu_security.single_sign_on_token_extractor" class="Sulu\Bundle\SecurityBundle\SingleSignOn\SingleSignOnTokenExtractor">
+            <argument type="service" id="sulu_security.single_sign_provider"/>
+        </service>
+
+        <service id="sulu_security.single_sign_on_token_handler" class="Sulu\Bundle\SecurityBundle\SingleSignOn\SingleSignOnTokenHandler">
+            <argument type="service" id="sulu_security.single_sign_provider"/>
+            <argument type="service" id="http_client"/>
+        </service>
     </services>
 </container>
diff --git a/src/Sulu/Bundle/SecurityBundle/Security/OpenIdLoginSubscriber.php b/src/Sulu/Bundle/SecurityBundle/Security/OpenIdLoginSubscriber.php
deleted file mode 100644
index dfa8106b558..00000000000
--- a/src/Sulu/Bundle/SecurityBundle/Security/OpenIdLoginSubscriber.php
+++ /dev/null
@@ -1,58 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Sulu\Bundle\SecurityBundle\Security;
-
-use Symfony\Component\EventDispatcher\EventSubscriberInterface;
-use Symfony\Component\HttpFoundation\JsonResponse;
-use Symfony\Component\HttpKernel\Event\RequestEvent;
-
-class OpenIdLoginSubscriber implements EventSubscriberInterface
-{
-    final public const OPEN_ID_ATTRIBUTES = '_app_open_id_attributes';
-
-    public static function getSubscribedEvents(): array
-    {
-        return [
-            RequestEvent::class => [
-                ['onKernelRequest', 9],
-            ],
-        ];
-    }
-
-    public function onKernelRequest(RequestEvent $event): void
-    {
-        if (!$event->isMainRequest()) {
-            return;
-        }
-
-        $request = $event->getRequest();
-
-        if (!$request->isMethod('POST')) {
-            return;
-        }
-
-        $route = $request->attributes->get('_route');
-        if ('sulu_admin.login_check' !== $route) {
-            return;
-        }
-
-        $email = $request->request->get('username');
-        $password = $request->request->get('password');
-
-        if (!$email || !\is_string($email)) {
-            return;
-        }
-
-        // Also return when email and password are set
-        if ($password) {
-            return;
-        }
-
-        // Todo: Implement single sign on.
-        //$event->setResponse(new JsonResponse(['method' => 'redirect', 'url' => 'https://www.google.at'], 200));
-        $event->setResponse(new JsonResponse(['method' => 'json_login'], 200));
-        $event->stopPropagation();
-    }
-}
diff --git a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/Adapter/OpenId/OpenIdSingleSignOnAdapter.php b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/Adapter/OpenId/OpenIdSingleSignOnAdapter.php
index d3322f86af8..016d4b3748e 100644
--- a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/Adapter/OpenId/OpenIdSingleSignOnAdapter.php
+++ b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/Adapter/OpenId/OpenIdSingleSignOnAdapter.php
@@ -1,5 +1,7 @@
 <?php
 
+declare(strict_types=1);
+
 /*
  * This file is part of Sulu.
  *
@@ -11,10 +13,20 @@
 
 namespace Sulu\Bundle\SecurityBundle\SingleSignOn\Adapter\OpenId;
 
+use Doctrine\ORM\EntityManagerInterface;
 use Ramsey\Uuid\Uuid;
+use Sulu\Bundle\ContactBundle\Entity\ContactRepositoryInterface;
+use Sulu\Bundle\SecurityBundle\Entity\Role;
+use Sulu\Bundle\SecurityBundle\Entity\User;
+use Sulu\Bundle\SecurityBundle\Entity\UserRole;
 use Sulu\Bundle\SecurityBundle\SingleSignOn\SingleSignOnAdapterInterface;
+use Sulu\Component\Security\Authentication\RoleRepositoryInterface;
+use Sulu\Component\Security\Authentication\UserRepositoryInterface;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Exception\HttpException;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Http\AccessToken\Oidc\Exception\MissingClaimException;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
 use Symfony\Contracts\HttpClient\HttpClientInterface;
 
 /**
@@ -22,17 +34,24 @@
  */
 class OpenIdSingleSignOnAdapter implements SingleSignOnAdapterInterface
 {
-    private const OPEN_ID_ATTRIBUTES = '_sulu_security_open_id_attributes';
+    final public const OPEN_ID_ATTRIBUTES = '_sulu_security_open_id_attributes';
 
     public function __construct(
         private HttpClientInterface $httpClient,
+        private readonly UserRepositoryInterface $userRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly ContactRepositoryInterface $contactRepository,
+        private readonly RoleRepositoryInterface $roleRepository,
+        private readonly UrlGeneratorInterface $urlGenerator,
         private string $endpoint,
         private string $clientId,
-        #[\SensitiveParameter] private string $clientSecret,
+        #[\SensitiveParameter]
+        private string $clientSecret,
+        private string $userRole,
     ) {
     }
 
-    public function generateLoginUrl(Request $request, string $redirectUrl): string
+    public function generateLoginUrl(Request $request, string $redirectUrl, string $domain): string
     {
         $openIdConfiguration = $this->httpClient->request('GET', $this->endpoint)->toArray();
         $authorizationEndpoint = $openIdConfiguration['authorization_endpoint'] ?? null;
@@ -45,6 +64,8 @@ public function generateLoginUrl(Request $request, string $redirectUrl): string
             $redirectUrl,
         );
 
+        $authorizationObject['attributes']['domain'] = $domain;
+
         $request->getSession()->set(self::OPEN_ID_ATTRIBUTES, $authorizationObject['attributes']);
 
         return $authorizationObject['url'];
@@ -97,4 +118,128 @@ private function generateAuthorizationUrl(
             'attributes' => $attributes,
         ];
     }
+
+    /**
+     * @param array<string, string|int|null> $expectedAttributes
+     * @param array<string, mixed> $givenAttributes
+     */
+    public function isAuthorizationValid(array $expectedAttributes, array $givenAttributes): bool
+    {
+        if (!isset($expectedAttributes['state'])
+            || $expectedAttributes['state'] !== $givenAttributes['state']) {
+            return false;
+        }
+
+        return true;
+    }
+
+    public function createOrUpdateUser(string $token): UserBadge
+    {
+        $openIdConfiguration = $this->httpClient->request('GET', $this->endpoint)->toArray();
+        $tokenEndpoint = $openIdConfiguration['token_endpoint'] ?? null;
+
+        if (!$tokenEndpoint) {
+            throw new \RuntimeException('No "token_endpoint" found in OpenId configuration from: ' . $this->endpoint);
+        }
+
+        $userinfoEndpoint = $openIdConfiguration['userinfo_endpoint'] ?? null;
+        if (!$userinfoEndpoint) {
+            throw new \RuntimeException('No "userinfo_endpoint" found in OpenId configuration from: ' . $this->endpoint);
+        }
+
+        $redirectUrl = $this->urlGenerator->generate('sulu_admin', [], UrlGeneratorInterface::ABSOLUTE_URL);
+
+        $tokenUrl = $this->generateTokenUrl(
+            $tokenEndpoint,
+            $token,
+            $redirectUrl,
+        );
+
+        $data = $this->httpClient->request(
+            'POST',
+            $tokenUrl['url'],
+            [
+                'headers' => $tokenUrl['headers'],
+                'body' => $tokenUrl['body'],
+            ],
+        )->toArray();
+
+        $accessToken = $data['access_token'];
+
+        $attributes = $this->httpClient->request('GET', $userinfoEndpoint, [
+            'auth_bearer' => $accessToken,
+        ])->toArray();
+
+        $identifier = $attributes['email'] ?? null;
+
+        if (null === $identifier) {
+            throw new MissingClaimException('"email claim not found on OIDC server response".');
+        }
+
+        $this->createOrUpdateAdminUser($identifier, $attributes);
+
+        return new UserBadge($identifier, null, $attributes);
+    }
+
+    private function generateTokenUrl(string $tokenEndpoint, string $token, string $redirectUrl)
+    {
+        return [
+            'url' => $tokenEndpoint,
+            'headers' => [
+                'Content-Type' => 'application/x-www-form-urlencoded',
+            ],
+            'body' => \http_build_query([
+                'grant_type' => 'authorization_code',
+                'code' => $token,
+                'client_id' => $this->clientId,
+                'client_secret' => $this->clientSecret,
+                'redirect_uri' => $redirectUrl,
+            ]),
+        ];
+    }
+
+    private function createOrUpdateAdminUser(string $email, array $attributes): void
+    {
+        $user = $this->userRepository->findOneBy(['email' => $email]);
+
+        if (!$user instanceof User) {
+            $user = new User();
+            $user->setEmail($email);
+            $user->setUsername($email);
+            $user->setPassword(Uuid::uuid4()->toString()); // create a random password as a password is required
+            $user->setSalt(\base64_encode(\random_bytes(32))); // copied from sulu SaltGenerator
+            $user->setEnabled(true);
+
+            $contact = $this->contactRepository->createNew();
+
+            $user->setContact($contact);
+
+            $this->entityManager->persist($user);
+            $this->entityManager->persist($contact);
+        }
+
+        $roleNames = $user->getRoles();
+
+        $role = $this->roleRepository->findOneBy(['key' => $this->userRole]);
+
+        if (!$role instanceof Role) {
+            throw new \RuntimeException('Role with Key "' . $this->userRole . '" not found for OIDC user: "' . $email . '"');
+        }
+
+        if (!\in_array($role->getIdentifier(), $roleNames, true)) {
+            $userRole = new UserRole();
+            $userRole->setRole($role);
+            $userRole->setUser($user);
+            $userRole->setLocale('["en", "de"]');
+            $user->addUserRole($userRole);
+            $this->entityManager->persist($userRole);
+        }
+
+        $contact = $user->getContact();
+        $contact->setFirstName($attributes['given_name'] ?? '');
+        $contact->setLastName($attributes['family_name'] ?? '');
+        $user->setLocale((isset($attributes['locale']) && 'de' === $attributes['locale']) ? 'de' : 'en');
+
+        $this->entityManager->flush();
+    }
 }
diff --git a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/Adapter/OpenId/OpenIdSingleSignOnAdapterFactory.php b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/Adapter/OpenId/OpenIdSingleSignOnAdapterFactory.php
index c384bd120af..6352d3b3276 100644
--- a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/Adapter/OpenId/OpenIdSingleSignOnAdapterFactory.php
+++ b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/Adapter/OpenId/OpenIdSingleSignOnAdapterFactory.php
@@ -11,8 +11,13 @@
 
 namespace Sulu\Bundle\SecurityBundle\SingleSignOn\Adapter\OpenId;
 
+use Doctrine\ORM\EntityManagerInterface;
+use Sulu\Bundle\ContactBundle\Entity\ContactRepositoryInterface;
 use Sulu\Bundle\SecurityBundle\SingleSignOn\SingleSignOnAdapterFactoryInterface;
 use Sulu\Bundle\SecurityBundle\SingleSignOn\SingleSignOnAdapterInterface;
+use Sulu\Component\Security\Authentication\RoleRepositoryInterface;
+use Sulu\Component\Security\Authentication\UserRepositoryInterface;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
 use Symfony\Contracts\HttpClient\HttpClientInterface;
 
 /**
@@ -22,25 +27,37 @@
  */
 class OpenIdSingleSignOnAdapterFactory implements SingleSignOnAdapterFactoryInterface
 {
-    public function __construct(private HttpClientInterface $httpClient)
-    {
+    public function __construct(
+        private HttpClientInterface $httpClient,
+        private readonly UserRepositoryInterface $userRepository,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly ContactRepositoryInterface $contactRepository,
+        private readonly RoleRepositoryInterface $roleRepository,
+        private readonly UrlGeneratorInterface $urlGenerator,
+    ) {
     }
 
-    public function createAdapter(#[\SensitiveParameter] array $dsn): SingleSignOnAdapterInterface
+    public function createAdapter(#[\SensitiveParameter] array $dsn, string $userRole): SingleSignOnAdapterInterface
     {
         $endpoint = (($dsn['query']['no-tls'] ?? false) ? 'http' : 'https') . '://' // http://
             . $dsn['host']                                                          // example.org
-            . ($dsn['port'] ? ':' . $dsn['port'] : '')                              // :8081
-            . $dsn['path'];                                                         // /.well-known/openid-configuration
+            . (($dsn['port'] ?? null) ? ':' . $dsn['port'] : '')                    // :8081
+            . ($dsn['path'] ?? '');                                                 // /.well-known/openid-configuration
 
         $clientId = $dsn['user'] ?? '';
         $clientSecret = $dsn['pass'] ?? '';
 
         return new OpenIdSingleSignOnAdapter(
             $this->httpClient,
+            $this->userRepository,
+            $this->entityManager,
+            $this->contactRepository,
+            $this->roleRepository,
+            $this->urlGenerator,
             $endpoint,
             $clientId,
             $clientSecret,
+            $userRole,
         );
     }
 
diff --git a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterFactory.php b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterFactory.php
index ac15c35c67b..1393da285d1 100644
--- a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterFactory.php
+++ b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterFactory.php
@@ -138,10 +138,10 @@ public function parseDsn(#[\SensitiveParameter] string $dsn): array
         return $parsedDsn;
     }
 
-    public function createAdapter(#[\SensitiveParameter] string $dsn): SingleSignOnAdapterFactoryInterface
+    public function createAdapter(#[\SensitiveParameter] string $dsn, string $userRole): SingleSignOnAdapterInterface
     {
         $parsedDsn = $this->parseDsn($dsn);
 
-        return $this->factories[$parsedDsn['scheme']]->createAdapter($parsedDsn);
+        return $this->factories[$parsedDsn['scheme']]->createAdapter($parsedDsn, $userRole);
     }
 }
diff --git a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterFactoryInterface.php b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterFactoryInterface.php
index 337657efa0b..dd8088e7d87 100644
--- a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterFactoryInterface.php
+++ b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterFactoryInterface.php
@@ -28,7 +28,7 @@ interface SingleSignOnAdapterFactoryInterface
      *     fragment?: string,
      * } $dsn
      */
-    public function createAdapter(#[\SensitiveParameter] array $dsn): SingleSignOnAdapterInterface;
+    public function createAdapter(#[\SensitiveParameter] array $dsn, string $userRole): SingleSignOnAdapterInterface;
 
     /**
      * Returns the expected DSN scheme for this adapter.
diff --git a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterInterface.php b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterInterface.php
index 17cf605296d..7264fadf518 100644
--- a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterInterface.php
+++ b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterInterface.php
@@ -12,11 +12,16 @@
 namespace Sulu\Bundle\SecurityBundle\SingleSignOn;
 
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
 
 /**
  * @experimental
  */
 interface SingleSignOnAdapterInterface
 {
-    public function generateLoginUrl(Request $request, string $redirectUrl): string;
+    public function generateLoginUrl(Request $request, string $redirectUrl, string $domain): string;
+
+    public function isAuthorizationValid(array $expectedAttributes, array $givenAttributes): bool;
+
+    public function createOrUpdateUser(string $token): UserBadge;
 }
diff --git a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterProvider.php b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterProvider.php
new file mode 100644
index 00000000000..567f96cc984
--- /dev/null
+++ b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnAdapterProvider.php
@@ -0,0 +1,35 @@
+<?php
+
+/*
+ * This file is part of Sulu.
+ *
+ * (c) Sulu GmbH
+ *
+ * This source file is subject to the MIT license that is bundled
+ * with this source code in the file LICENSE.
+ */
+
+namespace Sulu\Bundle\SecurityBundle\SingleSignOn;
+
+class SingleSignOnAdapterProvider
+{
+    /**
+     * @param arra<string, string> $mapping mapping from domain to DSN
+     */
+    public function __construct(
+        private readonly SingleSignOnAdapterFactory $factory,
+        private readonly array $mapping,
+    ) {
+    }
+
+    public function getAdapterByDomain(string $domain): ?SingleSignOnAdapterInterface
+    {
+        if (!isset($this->mapping[$domain])) {
+            return null;
+        }
+
+        $adapter = $this->factory->createAdapter($this->mapping[$domain]['dsn'], $this->mapping[$domain]['user_role']);
+
+        return $adapter;
+    }
+}
diff --git a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnLoginRequestSubscriber.php b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnLoginRequestSubscriber.php
new file mode 100644
index 00000000000..58faef5785c
--- /dev/null
+++ b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnLoginRequestSubscriber.php
@@ -0,0 +1,109 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of Sulu.
+ *
+ * (c) Sulu GmbH
+ *
+ * This source file is subject to the MIT license that is bundled
+ * with this source code in the file LICENSE.
+ */
+
+namespace Sulu\Bundle\SecurityBundle\SingleSignOn;
+
+use Sulu\Bundle\SecurityBundle\Entity\UserRepository;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+
+/**
+ * @final
+ *
+ * @internal
+ *
+ * @experimental
+ */
+class SingleSignOnLoginRequestSubscriber implements EventSubscriberInterface
+{
+    public function __construct(
+        private readonly SingleSignOnAdapterProvider $singleSignOnAdapterProvider,
+        private readonly UrlGeneratorInterface $urlGenerator,
+        private readonly UserRepository $userRepository,
+    ) {
+    }
+
+    public static function getSubscribedEvents(): array
+    {
+        return [
+            RequestEvent::class => [
+                ['onKernelRequest', 9],
+            ],
+        ];
+    }
+
+    public function onKernelRequest(RequestEvent $event): void
+    {
+        if (!$event->isMainRequest()) {
+            return;
+        }
+
+        $request = $event->getRequest();
+
+        if (!$request->isMethod('POST')) {
+            return;
+        }
+
+        $route = $request->attributes->get('_route');
+        if (!\in_array($route, ['sulu_admin.login_check', 'sulu_security.reset_password.email'])) {
+            return;
+        }
+
+        $isResetPassword = 'sulu_security.reset_password.email' === $route;
+        $identifier = $request->request->get('username') ?? $request->request->get('user');
+        $password = $request->request->get('password');
+
+        if (!$identifier || !\is_string($identifier)) {
+            return;
+        }
+
+        // Todo: Change this, userRepository should not return an error if there was no user found.
+        try {
+            $user = $this->userRepository->findUserByIdentifier($identifier);
+            $email = $user->getEmail() ?? $user->getUsername();
+        } catch (\Exception $e) {
+            $email = $identifier;
+        }
+
+        $domain = \explode('@', $email)[1] ?? null;
+        if (!$domain) {
+            if ($password || $isResetPassword) {
+                return;
+            }
+
+            $event->setResponse(new JsonResponse(['method' => 'json_login'], 200));
+            $event->stopPropagation();
+
+            return;
+        }
+
+        $adapter = $this->singleSignOnAdapterProvider->getAdapterByDomain($domain);
+        if (!$adapter) {
+            if ($password) {
+                return;
+            }
+
+            $event->setResponse(new JsonResponse(['method' => 'json_login'], 200));
+            $event->stopPropagation();
+
+            return;
+        }
+
+        $adminRoute = $this->urlGenerator->generate('sulu_admin', [], UrlGeneratorInterface::ABSOLUTE_URL);
+        $loginUrl = $adapter->generateLoginUrl($request, $adminRoute, $domain);
+        $event->setResponse(new JsonResponse(['method' => 'redirect', 'url' => $loginUrl], 200));
+        $event->stopPropagation();
+    }
+}
diff --git a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnTokenExtractor.php b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnTokenExtractor.php
new file mode 100644
index 00000000000..ab268fa19c2
--- /dev/null
+++ b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnTokenExtractor.php
@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of Sulu.
+ *
+ * (c) Sulu GmbH
+ *
+ * This source file is subject to the MIT license that is bundled
+ * with this source code in the file LICENSE.
+ */
+
+namespace Sulu\Bundle\SecurityBundle\SingleSignOn;
+
+use Sulu\Bundle\SecurityBundle\SingleSignOn\Adapter\OpenId\OpenIdSingleSignOnAdapter;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\Security\Http\AccessToken\AccessTokenExtractorInterface;
+
+final class SingleSignOnTokenExtractor implements AccessTokenExtractorInterface
+{
+    public function __construct(private readonly SingleSignOnAdapterProvider $singleSignOnAdapterProvider)
+    {
+    }
+
+    public function extractAccessToken(Request $request): ?string
+    {
+        $code = $request->query->get('code');
+        $state = $request->query->get('state');
+        $routeName = $request->attributes->get('_route');
+
+        if (!$code || !$state || 'sulu_admin' !== $routeName) {
+            return null;
+        }
+
+        if (!$request->getSession()->has(OpenIdSingleSignOnAdapter::OPEN_ID_ATTRIBUTES)) {
+            return null;
+        }
+
+        /** @var array{domain: string, state?: string} $expectedAttributes */
+        $expectedAttributes = $request->getSession()->get(OpenIdSingleSignOnAdapter::OPEN_ID_ATTRIBUTES);
+        // $request->getSession()->remove(OpenIdSingleSignOnAdapter::OPEN_ID_ATTRIBUTES); // TODO fix issue when we are removing the attributes from the session
+        $adapter = $this->singleSignOnAdapterProvider->getAdapterByDomain($expectedAttributes['domain']);
+
+        if (!$adapter->isAuthorizationValid($expectedAttributes, $request->query->all())) {
+            throw new AccessDeniedHttpException('Invalid authorization via OpenId provider.');
+        }
+
+        return $expectedAttributes['domain'] . '::' . $code;
+    }
+}
diff --git a/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnTokenHandler.php b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnTokenHandler.php
new file mode 100644
index 00000000000..cbb7bdec2be
--- /dev/null
+++ b/src/Sulu/Bundle/SecurityBundle/SingleSignOn/SingleSignOnTokenHandler.php
@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of Sulu.
+ *
+ * (c) Sulu GmbH
+ *
+ * This source file is subject to the MIT license that is bundled
+ * with this source code in the file LICENSE.
+ */
+
+namespace Sulu\Bundle\SecurityBundle\SingleSignOn;
+
+use Symfony\Component\Security\Http\AccessToken\AccessTokenHandlerInterface;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
+
+final class SingleSignOnTokenHandler implements AccessTokenHandlerInterface
+{
+    public function __construct(
+        private readonly SingleSignOnAdapterProvider $singleSignOnAdapterProvider,
+    ) {
+    }
+
+    public function getUserBadgeFrom(string $accessToken): UserBadge
+    {
+        try {
+            [$domain, $token] = \explode('::', $accessToken, 2);
+            $adapter = $this->singleSignOnAdapterProvider->getAdapterByDomain($domain);
+
+            return $adapter->createOrUpdateUser($token);
+        } catch (\Exception $e) {
+            throw new \Exception($e->getMessage());
+        }
+    }
+}