---
title: "Usage"
manual: "SSO Auth"
version: "1.0"
permalink: "https://docs.typo3.org/permalink/davitec/dv-sso-auth:usage@1.0"
source: "Usage/Index.rst"
rendered: "2026-10-12T13:53:34+00:00"
---

# Usage {#usage}

**On this page**

-   [Frontend login flow](https://docs.typo3.org/permalink/davitec/dv-sso-auth:frontend-login-flow@1.0)
-   [Redirect behavior after frontend login](https://docs.typo3.org/permalink/davitec/dv-sso-auth:redirect-behavior-after-frontend-login@1.0)
-   [Backend login flow](https://docs.typo3.org/permalink/davitec/dv-sso-auth:backend-login-flow@1.0)
-   [Restrict backend access to SSO only](https://docs.typo3.org/permalink/davitec/dv-sso-auth:restrict-backend-access-to-sso-only@1.0)
-   [Auto-import and updates](https://docs.typo3.org/permalink/davitec/dv-sso-auth:auto-import-and-updates@1.0)
-   [Recover from stale FE session cookies](https://docs.typo3.org/permalink/davitec/dv-sso-auth:recover-from-stale-fe-session-cookies@1.0)
-   [Typical setup example](https://docs.typo3.org/permalink/davitec/dv-sso-auth:typical-setup-example@1.0)

## Frontend login flow {#frontend-login-flow}

Use the **SSO Login** plugin (`dvssoauth_login`) on a frontend page.

Default behavior:

1.  Anonymous users see an **SSO Login** link.
1.  The link points to `loginHandler` with an encoded `target` URL.
1.  The target URL is normalized to contain `logintype=login` and `pid`
    (including signed PID if TYPO3 login signing is active).
1.  After successful IdP authentication, TYPO3 authenticates the user by the
    configured `remoteUser` variable.
1.  Logged-in users see a logout action that redirects to `logoutHandler`
    with `return=<site-root-url>`.

## Redirect behavior after frontend login {#redirect-behavior-after-frontend-login}

After login, `FrontendLoginController::loginSuccessAction()` redirects in
this order:

1.  `redirect_url` request parameter (if present)
1.  FlexForm setting `settings.redirectPage` (if configured)
1.  Otherwise, the plugin renders the logout view directly

## Backend login flow {#backend-login-flow}

When `enableBE` is enabled:

-   A dedicated backend login provider is registered.
-   TYPO3 login page (`/typo3/login`) shows an SSO login button.
-   The login button points to `loginHandler` with target
    `/typo3/?login_status=login`.
-   On backend logout, the extension removes the first cookie whose name starts
    with `_shibsession_`.

## Restrict backend access to SSO only {#restrict-backend-access-to-sso-only}

Set `onlySsoBE = 1` to deny backend login attempts without valid SSO
context.

Behavior on denied login:

-   If `EXTCONF['dv_sso_auth']['onlySsoFunc']` handlers are registered, they
    are executed.
-   Otherwise, the service throws a backend exception
    (`Login without SSO is not permitted.`).

## Auto-import and updates {#auto-import-and-updates}

### Frontend users {#frontend-users}

With `enableAutoImport = 1`:

-   Missing FE users are created in `storagePid`.
-   Existing FE users are updated on login.
-   `email`, `name` and `usergroup` are synchronized from IdP attributes.
-   FE groups are auto-created in `storagePid` by affiliation title if missing.

### Backend users {#backend-users}

With `enableBackendAutoImport = 1`:

-   Missing BE users are created with `pid = 0`.
-   Existing BE users are updated on login.
-   BE groups are created from affiliation titles when missing.
-   User-to-group assignment is derived from parsed affiliations.
-   If `backendAutoImportGroup` is set, user creation only happens when this
    affiliation is present.

## Recover from stale FE session cookies {#recover-from-stale-fe-session-cookies}

The middleware `ResetBrokenFrontendSessionMiddleware` handles a common edge
case:

-   A request has an FE session cookie and is SSO-related.
-   TYPO3 responds with `403` because session/auth state is stale.

Then the middleware:

1.  Expires the FE cookie.
1.  Redirects once to the same URL with `ssoSessionRetry=1`.
1.  If retry still returns `403`, the response is returned as-is (no loop).

## Typical setup example {#typical-setup-example}

```none
Root
+-- Login
|   Content: SSO Login plugin
+-- Protected area
+-- Logged-in landing page (optional, used as redirectPage)
+-- Storage (SysFolder, not in menu)
    Stores: FE users and FE groups for auto-import
```

Configuration summary for this setup:

-   `enableFE = 1`
-   `enableAutoImport = 1` (optional)
-   `storagePid = <uid-of-storage-folder>`
-   FlexForm `settings.redirectPage = <uid-of-landing-page>` (optional)