Skip to content

Extension points

The primary supported extension point is replacing how the authenticated username is read.

Override ldap_sso.server_variable

Implement Drupal\ldap_sso\ServerVariableLookupInterface:

public function getAuthenticationNameFromServer(?string $variable): ?string;

Register your class over the default service in a custom module’s *.services.yml:

services:
  ldap_sso.server_variable:
    class: Drupal\my_module\ServerVariableLookup

Use this for:

  • Custom reverse-proxy headers
  • Non-standard CGI/FastCGI variable names beyond config
  • Test doubles (see Testing)

The test module ldap_sso_dummy_ldap overrides the service and returns a fixed username when the request URI contains /user/login/sso.

Config

All runtime toggles live in ldap_sso.settings. Deploy via configuration management; see Configuration API.

LDAP ecosystem

Account validation, creation, and field mapping are owned by:

  • ldap_authentication (LoginValidatorSso)
  • ldap_user
  • externalauth
  • Optionally ldap_authorization when present

Extend those modules (servers, authmap, provisioning triggers) when SSO finds the identity but Drupal login still fails.

What is not available

  • No plugin types under ldap_sso
  • No custom events dispatched by this module
  • No hook_ldap_sso_* alter hooks

If you need to change redirect destinations or cookie names, that currently requires a custom module that replaces services or patches—there is no first-class alter API for those behaviors.