Skip to content

Web server setup

LDAP SSO trusts whatever identity the web server puts in a PHP server variable (usually REMOTE_USER). Drupal does not implement NTLM or Kerberos itself.

Protect only /user/login/sso so anonymous visitors can still browse the site. Authenticate that path with NTLM, Kerberos, or basic auth backed by your directory.

To require authentication for the whole site, protect / instead (or the virtual host). To auto-login Drupal users after the web server has authenticated them, enable seamless SSO in Drupal—after path-based SSO works.

Supported “standard” Apache modules:

Install and configure those modules from their own documentation or your distribution’s packages. Below is only the Drupal-relevant location block.

Apache example (mod_auth_sspi)

Load the module in httpd.conf (paths vary by install):

LoadModule sspi_auth_module modules/mod_auth_sspi.so

In the virtual host, protect the SSO path:

<Location /user/login/sso>
  AuthType SSPI
  AuthName "Example.com - Login using your LDAP user name and password"
  SSPIAuth On
  SSPIAuthoritative On
  # Domain must match your directory / LDAP server setup in Drupal.
  SSPIDomain ad.example.com
  SSPIOmitDomain On
  SSPIOfferBasic On
  Require valid-user
</Location>

With SSPIOmitDomain On, leave Split user name and realm and domain stripping off unless you still see domain-qualified names in Drupal.

Kerberos (mod_auth_kerb)

On Linux, configure Kerberos for /user/login/sso per your OS and mod_auth_kerb docs. Kerberos often yields user@REALM; enable Split user name and realm in Drupal (on by default).

If the variable is not REMOTE_USER after redirects, try REDIRECT_REMOTE_USER in the SSO admin form.

Browser behavior

  • Many browsers prompt for credentials on /user/login/sso unless the site is treated as intranet / trusted for integrated Windows authentication.
  • Internet Explorer and Edge on domain-joined machines may pass NTLM automatically; Firefox and Chrome need explicit settings for silent SSO.

Verify the web server before Drupal

With the location configured, visit /user/login/sso:

Result Meaning
Browser prompts; correct LDAP credentials accepted Web-server auth works
404 Page not found Auth worked; LDAP SSO module not enabled
Access denied Module enabled but you are already logged into Drupal
“You have been successfully authenticated” Full SSO path works

See Troubleshooting for Drupal-side failures after the prompt succeeds.