Installation 

On this page

Requirements 

  • TYPO3 12.4 LTS, 13.4 LTS or 14
  • PHP 8.1 or newer (see exact constraints in composer.json)
  • Working SSO/IdP setup (e.g. Shibboleth SP) providing server variables such as REMOTE_USER

Install via Composer 

Run in your TYPO3 project root:

composer require davitec/dv-sso-auth
Copied!

For Composer-based installations the extension is activated automatically.

If required, verify activation in Admin Tools > Extension Manager.

Configure extension settings 

Open Admin Tools > Settings > Extension Configuration and configure dv_sso_auth.

Minimum useful setup:

  1. Enable at least one login context:

    • enableBE for TYPO3 backend SSO
    • enableFE for TYPO3 frontend SSO

  2. Set handler paths if your Shibboleth endpoints differ:

    • loginHandler (default: /Shibboleth.sso/Login)
    • logoutHandler (default: /Shibboleth.sso/Logout)

  3. Verify IdP variable mapping:

    • remoteUser (default: REMOTE_USER)
    • mail (default: mail)
    • displayName (default: displayName)
    • eduPersonAffiliation (default: affiliation)
  4. If FE user auto-import is enabled, configure storagePid to the SysFolder that should contain FE users and FE groups.

Include TypoScript 

The extension provides TypoScript in:

  • EXT:dv_sso_auth/Configuration/TypoScript/constants.typoscript
  • EXT:dv_sso_auth/Configuration/TypoScript/setup.typoscript

Import it in your site package TypoScript:

@import 'EXT:dv_sso_auth/Configuration/TypoScript/constants.typoscript'
@import 'EXT:dv_sso_auth/Configuration/TypoScript/setup.typoscript'
Copied!

Frontend plugin setup 

For frontend SSO, create a content element with plugin SSO Login (dvssoauth_login).

If enableFE is active, the plugin provides a FlexForm field settings.redirectPage to define the page shown after successful login when no redirect_url parameter is present.

Quick verification 

  1. Frontend: open a page with the SSO Login plugin and trigger login.
  2. Backend: open /typo3/login and verify the SSO button is available when enableBE is enabled.
  3. Confirm that authenticated users are matched by username against the configured remoteUser server variable.