Configuration 

On this page

Extension configuration (ext_conf_template) 

Main settings are configured in TYPO3 extension configuration for dv_sso_auth.

Setting

Type

Default

Description

enableBE

bool

0

Enables SSO authentication integration for TYPO3 backend login.

enableFE

bool

0

Enables SSO authentication integration for TYPO3 frontend login.

enableAutoImport

bool

0

Automatically creates/updates FE users from IdP attributes when they do not exist or have changed.

enableBackendAutoImport

bool

0

Automatically creates/updates BE users from IdP attributes.

backendAutoImportGroup

string

BackendGroup

Required affiliation for BE auto-import. If empty, all affiliations are accepted.

FE_fetchUserIfNoSession

bool

0

Forces FE auth service execution even if no FE session exists.

BE_fetchUserIfNoSession

bool

1

Forces BE auth service execution even if no BE session exists.

forceSSL

bool

1

Forces generated login targets to https.

onlySsoBE

bool

0

Disallows backend login without SSO context. See Hooks / extension points.

priority

int (0-100)

90

TYPO3 auth service priority.

storagePid

int

0

Storage PID for FE users and FE groups created by auto-import.

loginHandler

string

/Shibboleth.sso/Login

SSO login endpoint path used for frontend and backend login links.

logoutHandler

string

/Shibboleth.sso/Logout

SSO logout endpoint path used for frontend logout redirect.

remoteUser

string

REMOTE_USER

Server variable containing the authenticated username.

mail

string

mail

Server variable containing the user email address.

displayName

string

displayName

Server variable containing display name / real name.

eduPersonAffiliation

string

affiliation

Server variable containing affiliation values for group mapping.

typo3LoginTemplate

string

EXT:dv_sso_auth/Resources/Private/Templates/BackendLogin/SsoLogin.html

Fluid template path for the TYPO3 backend login provider.

TypoScript 

The extension ships with TypoScript constants and setup for plugin view paths:

plugin.tx_dvssoauth {
  view {
    templateRootPath = EXT:dv_sso_auth/Resources/Private/Templates/
    partialRootPath = EXT:dv_sso_auth/Resources/Private/Partials/
    layoutRootPath = EXT:dv_sso_auth/Resources/Private/Layouts/
  }
}
Copied!

If needed, override these paths in your site package.

Frontend plugin and FlexForm 

The plugin is registered as dvssoauth_login.

Available FlexForm settings:

  • settings.redirectPage: page used after successful login if no explicit redirect_url was passed.
  • settings.logoutRedirectPage: currently defined in FlexForm but not used in controller logic.

Server variable resolution 

Server variables are resolved with fallback handling:

  • direct key lookup (example: REMOTE_USER)
  • prefixed lookup with REDIRECT_ (example: REDIRECT_REMOTE_USER)
  • scan all scalar $_SERVER keys and strip the REDIRECT_ prefix

This makes setups behind Apache rewrite/proxy layers more robust.

Affiliation parsing 

Affiliations are parsed from the configured server variable (eduPersonAffiliation):

  • split by ;
  • trim whitespace
  • strip domain suffixes after @ (member@example.org becomes member)
  • deduplicate values

For FE users, if no affiliation is available, the fallback group title member is used.

Hooks / extension points 

The auth service exposes extension points through $GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['dv_sso_auth']:

  • getFEUserGroups: post-process FE group UID list
  • getBEUserGroups: post-process BE group UID list
  • onlySsoFunc: custom behavior when onlySsoBE denies non-SSO login

Example registration:

$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['dv_sso_auth']['getFEUserGroups'][]
    = \Vendor\Site\Auth\FrontendGroupProcessor::class;

$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['dv_sso_auth']['getBEUserGroups'][]
    = \Vendor\Site\Auth\BackendGroupProcessor::class;

$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['dv_sso_auth']['onlySsoFunc'][]
    = \Vendor\Site\Auth\OnlySsoProcessor::class;
Copied!

Expected processor methods:

public function getFEUserGroups(array $groupUids): array {}
public function getBEUserGroups(array $groupUids): array {}
public function onlySsoFunc(?string $remoteUser): void {}
Copied!