LDAP SSO

LDAP SSO logs Drupal users in from an identity the web server already authenticated (NTLM, Kerberos, or similar). Drupal never collects the user’s password for SSO. The module reads a PHP server variable—usually REMOTE_USER—maps that name through the LDAP stack, and creates a Drupal session.

This module was originally part of the LDAP project and was split out for Drupal 8 and later.

Requirements

Requirement	Detail
Drupal	^10.3 || ^11 || ^12
Composer	drupal/ldap: ^4.4
Modules	ldap_servers, ldap_authentication
Web server	Auth that sets $_SERVER['REMOTE_USER'] (or another configured variable)

Two ways to use SSO

1. Path-based (recommended start) — Protect only /user/login/sso on the web server. Visitors hit that path (or a link to it) to authenticate; the rest of the site stays public.
2. Seamless — Enable Turn on automated single sign-on so anonymous requests redirect to /user/login/sso and back to the original page.

Documentation

• Site builders — Install, configure Drupal and the web server, understand logout cookies, and troubleshoot.
• Developers — Architecture, services, extension points, configuration API, and tests.