Logout and cookies
Seamless SSO and logout use two cookies so Drupal does not loop forever between
anonymous pages and /user/login/sso.
Cookies
| Cookie | Purpose |
|---|---|
sso_login_running |
Set when seamless SSO redirects to /user/login/sso. Cleared when the login controller finishes. Prevents redirect loops while login is in progress. |
sso_stop |
Set after failed SSO or on logout when seamless login is enabled. Blocks further seamless redirects for that browser until the cookie expires. |
Both use the site base_path as the cookie path.
sso_stop lifetime
Controlled by Invalidate SSO cookie immediately (cookieExpire):
| Setting | Behavior |
|---|---|
| Off (default) | Session cookie (expires = 0). Closing the browser clears it; seamless SSO can run again later. |
| On | Cookie is set already expired when stopping SSO, so the next anonymous request can seamless-login again immediately. |
On logout with seamless login enabled, hook_user_logout sets sso_stop the
same way so users are not immediately bounced back into an SSO session.
Logout redirect
When Redirect users on logout is enabled (default), logout sends the user
to Logout redirect path (default /user/login). Prefer a path that is
excluded from seamless SSO (login and logout paths are excluded by default).
Module conflicts
Logout redirect can conflict with Masquerade and Devel. Disable redirect on logout if those modules misbehave after SSO logout.
Practical tips
- After a failed SSO attempt, clear
sso_stop(or close the browser) before retrying seamless login with the default cookie settings. - Path-based SSO (visiting
/user/login/ssomanually) still works whensso_stopis present; only automated redirects are blocked. - Do not put cron or health-check URLs behind seamless SSO; add them under SSO Excluded Paths if needed.