Configuration
Admin form: /admin/config/people/ldap/sso
Config object: ldap_sso.settings
Settings
| Admin label | Config key | Default | When to use |
|---|---|---|---|
| Turn on automated single sign-on | seamlessLogin |
Off | Redirect anonymous users to /user/login/sso. Requires working web-server auth on that path (or the whole host). |
| Split user name and realm | ssoSplitUserRealm |
On | Identities like user@REALM (typical for mod_auth_kerb). Default for Kerberos; usually off for mod_auth_sspi with SSPIOmitDomain On. |
| Strip REMOTE_USER of domain name | ssoRemoteUserStripDomainName |
Off | Forms like user@domain or DOMAIN\user when you also support password login without the domain and want one Drupal account. |
| Invalidate SSO cookie immediately | cookieExpire |
Off | Controls how the sso_stop cookie expires after failed SSO or logout. Off = session cookie (cleared when the browser closes). On = expire immediately so seamless SSO can run again right away. |
| Server variable containing the user | ssoVariable |
REMOTE_USER |
PHP $_SERVER key. Common alternatives: REDIRECT_REMOTE_USER. |
| SSO Excluded Paths | ssoExcludedPaths |
(empty) | Paths skipped by seamless SSO (one per line; exact path match or <front>). Some system paths are always excluded. |
| SSO Excluded Hosts | ssoExcludedHosts |
(empty) | Hostnames where seamless SSO must not run (one per line). |
| Redirect users on logout | redirectOnLogout |
On | After logout, send users to a non-SSO path. Can conflict with Masquerade and Devel. |
| Logout redirect path | logoutRedirectPath |
/user/login |
Internal path (/, ?, or # prefix). Required when redirect on logout is on. |
| Show a confirmation message on successful login | enableLoginConfirmationMessage |
On | Status message: “You have been successfully authenticated”. |
LDAP server bind methods
The admin form rejects saving SSO settings if any enabled LDAP server uses
bind method user or anon_user. With SSO, Drupal never receives the user’s
password, so the LDAP module cannot bind as that user.
Use a service account bind (or anonymous bind, if your directory allows it and your security policy accepts it).
Always-excluded paths (seamless SSO)
These paths never trigger automated SSO, even if you do not list them under excluded paths:
/admin/config/search/clean-urls/check/user/login/sso/user/login/user/logout/user
Configuration management
Export/import ldap_sso.settings with the rest of your site config. Defaults
ship in config/install/ldap_sso.settings.yml.