diff --git a/plugins/login-external-sso/LICENSE b/plugins/login-external-sso/LICENSE
new file mode 100644
index 000000000..f709b02e2
--- /dev/null
+++ b/plugins/login-external-sso/LICENSE
@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 RainLoop Team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/plugins/login-external-sso/index.php b/plugins/login-external-sso/index.php
new file mode 100644
index 000000000..1dc559382
--- /dev/null
+++ b/plugins/login-external-sso/index.php
@@ -0,0 +1,56 @@
+<?php
+
+class LoginExternalSsoPlugin extends \RainLoop\Plugins\AbstractPlugin
+{
+	const
+		NAME     = 'Login External SSO',
+		AUTHOR   = 'SnappyMail',
+		URL      = 'https://snappymail.eu/',
+		VERSION  = '1.0',
+		RELEASE  = '2022-11-11',
+		REQUIRED = '2.21.0',
+		CATEGORY = 'Login',
+		LICENSE  = 'MIT',
+		DESCRIPTION = '';
+
+	public function Init() : void
+	{
+		$this->addPartHook('ExternalSso', 'ServiceExternalSso');
+	}
+
+	public function ServiceExternalSso() : string
+	{
+		$oActions = \RainLoop\Api::Actions();
+		$oActions->Http()->ServerNoCache();
+		$sKey = $this->Config()->Get('plugin', 'key', '');
+		$sEmail = $_POST['Email'];
+		$sPassword = $_POST['Password'];
+		if ($sEmail && $sPassword && $sKey && $_POST['SsoKey'] == $sKey) {
+			$sResult = \RainLoop\Api::CreateUserSsoHash($sEmail, $sPassword);
+			if ('json' == \strtolower($_POST['Output'] ?? 'Plain')) {
+				\header('Content-Type: application/json; charset=utf-8');
+				echo \json_encode(array(
+					'Action' => 'ExternalSso',
+					'Result' => $sResult
+				));
+			} else {
+				\header('Content-Type: text/plain');
+				echo $sResult;
+			}
+		}
+		return true;
+	}
+
+	/**
+	 * @return array
+	 */
+	public function configMapping() : array
+	{
+		return array(
+			// Was application.ini external_sso_key
+			Property::NewInstance('key')->SetLabel('SSO key')
+				->SetDefaultValue(''),
+		);
+	}
+
+}
diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Config/Application.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Config/Application.php
index c9abd31fd..33b04882c 100644
--- a/snappymail/v/0.0.0/app/libraries/RainLoop/Config/Application.php
+++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Config/Application.php
@@ -402,8 +402,6 @@ Enables caching in the system'),
 				'force_https' => array(false),
 				'custom_login_link' => array(''),
 				'custom_logout_link' => array(''),
-				'allow_external_sso' => array(false),
-				'external_sso_key' => array(''),
 				'http_client_ip_check_proxy' => array(false),
 				'fast_cache_memcache_host' => array('127.0.0.1'),
 				'fast_cache_memcache_port' => array(11211),
diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php b/snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
index d2c6da422..4717c29dc 100644
--- a/snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
+++ b/snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
@@ -734,32 +734,6 @@ class ServiceActions
 		return '';
 	}
 
-	public function ServiceExternalSso() : string
-	{
-		$this->oHttp->ServerNoCache();
-		$sResult = '';
-		$oConfig = $this->oActions->Config();
-		$sKey = $oConfig->Get('labs', 'external_sso_key', '');
-		$sEmail = \trim($_POST['Email']);
-		$sPassword = $_POST['Password'];
-		if ($oConfig->Get('labs', 'allow_external_sso', false)
-		 && $sEmail && $sPassword
-		 && $sKey && $_POST['SsoKey'] == $sKey
-		) {
-			$sResult = \RainLoop\Api::CreateUserSsoHash($sEmail, $sPassword);
-			if ('json' == \strtolower($_POST['Output'] ?? 'Plain')) {
-				\header('Content-Type: application/json; charset=utf-8');
-				$sResult = \json_encode(array(
-					'Action' => 'ExternalSso',
-					'Result' => $sResult
-				));
-			} else {
-				\header('Content-Type: text/plain');
-			}
-		}
-		return $sResult;
-	}
-
 	public function ErrorTemplates(string $sTitle, string $sDesc, bool $bShowBackLink = true) : string
 	{
 		return \strtr(\file_get_contents(APP_VERSION_ROOT_PATH.'app/templates/Error.html'), array(