Index: /usr/local/emhttp/plugins/dynamix/include/.login.php
===================================================================
--- /usr/local/emhttp/plugins/dynamix/include/.login.php	original
+++ /usr/local/emhttp/plugins/dynamix/include/.login.php	modified
@@ -1,6 +1,57 @@
 <?php
+
+
+function verifyUsernamePasswordAndSSO(string $username, string $password): bool {
+    if ($username != "root") return false;
+
+    $output = exec("/usr/bin/getent shadow $username");
+    if ($output === false) return false;
+    $credentials = explode(":", $output);
+    $valid = password_verify($password, $credentials[1]);
+    if ($valid) {
+        return true;
+    }
+    // We may have an SSO token, attempt validation
+    if (strlen($password) > 800) {
+        if (!preg_match('/^[A-Za-z0-9-_]+.[A-Za-z0-9-_]+.[A-Za-z0-9-_]+$/', $password)) {
+            my_logger("SSO Login Attempt Failed: Invalid token format");
+            return false;
+        }
+        $safePassword = escapeshellarg($password);
+
+        $output = array();
+        exec("/etc/rc.d/rc.unraid-api sso validate-token $safePassword 2>&1", $output, $code);
+        my_logger("SSO Login Attempt Code: $code");
+        my_logger("SSO Login Attempt Response: " . print_r($output, true));
+
+        if ($code !== 0) {
+            return false;
+        }
+
+        if (empty($output)) {
+            return false;
+        }
+
+        try {
+            // Split on first { and take everything after it
+            $jsonParts = explode('{', $output[0], 2);
+            if (count($jsonParts) < 2) {
+                my_logger("SSO Login Attempt Failed: No JSON found in response");
+                return false;
+            }
+            $response = json_decode('{' . $jsonParts[1], true);
+            if (isset($response['valid']) && $response['valid'] === true) {
+                return true;
+            }
+        } catch (Exception $e) {
+            my_logger("SSO Login Attempt Exception: " . $e->getMessage());
+            return false;
+        }
+    }
+    return false;
+}
 // Included in login.php
 
 // Only start a session to check if they have a cookie that looks like our session
 $server_name = strtok($_SERVER['HTTP_HOST'], ":");
 if (!empty($_COOKIE['unraid_'.md5($server_name)])) {
@@ -128,11 +179,11 @@
             }
             throw new Exception(_('Too many invalid login attempts'));
         }
 
         // Bail if username + password combo doesn't work
-        if (!verifyUsernamePassword($username, $password)) {
+        if (!verifyUsernamePasswordAndSSO($username, $password)) {
             throw new Exception(_('Invalid username or password'));
         }
 
         // Successful login, start session
         @unlink($failFile);
@@ -434,10 +485,11 @@
                     </p>
                     <?php if ($error) { ?>
                         <p class="error"><?= $error ?></p>
                     <?php } ?>
                 </form>
+<?php include "$docroot/plugins/dynamix.my.servers/include/sso-login.php"; ?>
             </div>
 
             <a href="https://docs.unraid.net/go/lost-root-password/" target="_blank"><?=_('Password recovery')?></a>
 
         </div>
