Site builders overview

Use this guide to get LDAP SSO working end to end. Most of the work is outside Drupal: the web server must authenticate the visitor and expose the username in a PHP server variable.

Recommended path

1. Configure one or more LDAP servers in Drupal with a service account or anonymous bind—not a bind method that needs the end user’s password.
2. Configure LDAP authentication and user provisioning so mapped accounts can be found or created.
3. Protect only /user/login/sso on the web server (NTLM/Kerberos/basic). See Web server setup.
4. Enable LDAP SSO and open Configuration → People → LDAP → SSO (/admin/config/people/ldap/sso), also available as the SSO tab on the LDAP servers list.
5. Visit /user/login/sso while anonymous and confirm a successful Drupal login. See Troubleshooting.
6. Optionally enable automated (seamless) single sign-on after path-based SSO works.

Start without seamless login

Leave Turn on automated single sign-on off until /user/login/sso works. That separates web-server problems from redirect/cookie loops.

Admin UI

Item	Value
Path	/admin/config/people/ldap/sso
Permission	Administer site configuration
Menu	LDAP servers collection → SSO tab

Details for each setting: Configuration.

Next

• Installation
• Configuration
• Web server setup
• Logout and cookies
• Troubleshooting