Skip to content

Troubleshooting

Verification checklist

Work through these in order.

  1. Web server auth — Visit /user/login/sso in a private window. You should get a credential prompt (or silent Windows auth). If not, fix Apache/IIS before touching Drupal settings.
  2. Module enabled — After auth, an enabled module shows Access denied when already logged in, or a success/error redirect when anonymous. A 404 means the module is not enabled.
  3. Server variable — Confirm ssoVariable matches what PHP sees (REMOTE_USER vs REDIRECT_REMOTE_USER). Enable LDAP detail logging if available and watch for “User missing” / variable-not-found messages.
  4. LDAP bind method — Enabled servers must not use user-password bind methods. The SSO admin form validates this on save.
  5. Username shape — Kerberos user@REALM needs Split user name and realm. DOMAIN\user or user@domain may need Strip REMOTE_USER of domain name so the name matches LDAP/Drupal accounts.
  6. Provisioning — LDAP authentication / ldap_user must allow finding or creating the Drupal account for that authname.
  7. Seamless last — Turn on automated SSO only after path-based login works.

Common symptoms

Symptom Likely cause
Prompt never appears Location not protected; wrong vhost; auth module not loaded
“You were not authenticated by the server” $_SERVER variable empty or wrong ssoVariable
“LDAP credentials were not found…” Authname does not match LDAP; bind failed; provisioning rules reject the user
Immediate re-login after logout Seamless on without working sso_stop; enable invalidate-immediately or fix logout redirect path
Redirect loop / blank response sso_login_running stuck; excluded paths misconfigured; web server sets REMOTE_USER on every path while seamless is on
Duplicate Drupal accounts Domain-qualified vs bare usernames; enable strip/split consistently with password login
Admin form save error about bind method Change LDAP server bind to service/anonymous

Logging

  • Channel: ldap_sso (Watchdog / Drupal logs).
  • LDAP detail log (ldap.detail_log) records SSO steps when detail logging is enabled in the LDAP stack.

Still stuck?

Confirm the same username works with normal LDAP password login (if allowed). If password login works but SSO does not, the problem is almost always the server variable value or domain/realm stripping—not LDAP connectivity.