---
title: "Configuration"
manual: "SSO Auth"
version: "main"
permalink: "https://docs.typo3.org/permalink/davitec/dv-sso-auth:configuration@main"
source: "Configuration/Index.rst"
rendered: "2026-10-12T13:45:55+00:00"
---

# Configuration {#configuration}

**On this page**

-   [Extension configuration (ext_conf_template)](https://docs.typo3.org/permalink/davitec/dv-sso-auth:extension-configuration-ext-conf-template@main)
-   [TypoScript](https://docs.typo3.org/permalink/davitec/dv-sso-auth:typoscript@main)
-   [Frontend plugin and FlexForm](https://docs.typo3.org/permalink/davitec/dv-sso-auth:frontend-plugin-and-flexform@main)
-   [Server variable resolution](https://docs.typo3.org/permalink/davitec/dv-sso-auth:server-variable-resolution@main)
-   [Affiliation parsing](https://docs.typo3.org/permalink/davitec/dv-sso-auth:affiliation-parsing@main)
-   [Hooks / extension points](https://docs.typo3.org/permalink/davitec/dv-sso-auth:hooks-extension-points@main)

## Extension configuration (ext_conf_template) {#extension-configuration-ext-conf-template}

Main settings are configured in TYPO3 extension configuration for
`dv_sso_auth`.

| Setting | Type | Default | Description |
| --- | --- | --- | --- |
| `enableBE` | bool | `0` | Enables SSO authentication integration for TYPO3 backend login. |
| `enableFE` | bool | `0` | Enables SSO authentication integration for TYPO3 frontend login. |
| `enableAutoImport` | bool | `0` | Automatically creates/updates FE users from IdP attributes when they do not exist or have changed. |
| `enableBackendAutoImport` | bool | `0` | Automatically creates/updates BE users from IdP attributes. |
| `backendAutoImportGroup` | string | `BackendGroup` | Required affiliation for BE auto-import. If empty, all affiliations are accepted. |
| `FE_fetchUserIfNoSession` | bool | `0` | Forces FE auth service execution even if no FE session exists. |
| `BE_fetchUserIfNoSession` | bool | `1` | Forces BE auth service execution even if no BE session exists. |
| `forceSSL` | bool | `1` | Forces generated login targets to `https`. |
| `onlySsoBE` | bool | `0` | Disallows backend login without SSO context. See [Hooks / extension points](https://docs.typo3.org/permalink/davitec/dv-sso-auth:onlyssobe-hook@main). |
| `priority` | int (0-100) | `90` | TYPO3 auth service priority. |
| `storagePid` | int | `0` | Storage PID for FE users and FE groups created by auto-import. |
| `loginHandler` | string | `/Shibboleth.sso/Login` | SSO login endpoint path used for frontend and backend login links. |
| `logoutHandler` | string | `/Shibboleth.sso/Logout` | SSO logout endpoint path used for frontend logout redirect. |
| `remoteUser` | string | `REMOTE_USER` | Server variable containing the authenticated username. |
| `mail` | string | `mail` | Server variable containing the user email address. |
| `displayName` | string | `displayName` | Server variable containing display name / real name. |
| `eduPersonAffiliation` | string | `affiliation` | Server variable containing affiliation values for group mapping. |
| `typo3LoginTemplate` | string | `EXT:dv_sso_auth/Resources/Private/Templates/BackendLogin/SsoLogin.html` | Fluid template path for the TYPO3 backend login provider. |

## TypoScript {#typoscript}

The extension ships with TypoScript constants and setup for plugin view paths:

```typoscript
plugin.tx_dvssoauth {
  view {
    templateRootPath = EXT:dv_sso_auth/Resources/Private/Templates/
    partialRootPath = EXT:dv_sso_auth/Resources/Private/Partials/
    layoutRootPath = EXT:dv_sso_auth/Resources/Private/Layouts/
  }
}
```

If needed, override these paths in your site package.

## Frontend plugin and FlexForm {#frontend-plugin-and-flexform}

The plugin is registered as `dvssoauth_login`.

Available FlexForm settings:

-   `settings.redirectPage`: page used after successful login if no explicit
    `redirect_url` was passed.
-   `settings.logoutRedirectPage`: currently defined in FlexForm but not used
    in controller logic.

## Server variable resolution {#server-variable-resolution}

Server variables are resolved with fallback handling:

-   direct key lookup (example: `REMOTE_USER`)
-   prefixed lookup with `REDIRECT_` (example: `REDIRECT_REMOTE_USER`)
-   scan all scalar `$_SERVER` keys and strip the `REDIRECT_` prefix

This makes setups behind Apache rewrite/proxy layers more robust.

## Affiliation parsing {#affiliation-parsing}

Affiliations are parsed from the configured server variable
(`eduPersonAffiliation`):

-   split by `;`
-   trim whitespace
-   strip domain suffixes after `@` (`member@example.org` becomes `member`)
-   deduplicate values

For FE users, if no affiliation is available, the fallback group title
`member` is used.

## Hooks / extension points {#onlyssobe-hook}

The auth service exposes extension points through
`$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['dv_sso_auth']`:

-   `getFEUserGroups`: post-process FE group UID list
-   `getBEUserGroups`: post-process BE group UID list
-   `onlySsoFunc`: custom behavior when `onlySsoBE` denies non-SSO login

Example registration:

```php
$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['dv_sso_auth']['getFEUserGroups'][]
    = \Vendor\Site\Auth\FrontendGroupProcessor::class;

$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['dv_sso_auth']['getBEUserGroups'][]
    = \Vendor\Site\Auth\BackendGroupProcessor::class;

$GLOBALS['TYPO3_CONF_VARS']['EXTCONF']['dv_sso_auth']['onlySsoFunc'][]
    = \Vendor\Site\Auth\OnlySsoProcessor::class;
```

Expected processor methods:

```php
public function getFEUserGroups(array $groupUids): array {}
public function getBEUserGroups(array $groupUids): array {}
public function onlySsoFunc(?string $remoteUser): void {}
```