Documentation
TYPO3 Module “Single-Sign-On”
Version 2.0.3 (04 Nov 2026)
Chapters of this Documentation
This extension makes TYPO3 a SAML 2.0 service provider. Editors and frontend users authenticate against an external identity provider—Microsoft Entra ID, KeyCloak, ADFS, or anything else that speaks SAML 2.0—and TYPO3 accepts the resulting assertion instead of a password.
Backend and frontend are separate service providers with their own entity IDs and their own configuration source, and either can be used without the other. Nothing happens until you point one of them at an identity provider: installing the extension alone changes no login screen.
Compatibility
TYPO3 v13.4 LTS and v14.3, PHP 8.3 or later. The ext-simplexml PHP extension is required because identity provider metadata is read as XML. SAML itself is handled by onelogin/php-saml 4.x, which is pulled in as a dependency.
Release notes live in the changelog.
Contents
| Chapter | What It Covers |
|---|---|
| Installation | Certificates, environment variables, extension settings, registering the app at the identity provider, endpoints, production checklist, smoke test |
| Configuration | Every configuration key, its default, and where it has to be set |
| How It Works | The request flow of a login and a logout, ?logintype=sso and ?logintype=slo |
| Backend Login | The provider switch, enforceSSO, the Install Tool as the way back in |
| Frontend Login | The contract with your own Login.html, redirect_url, enforceSSO per site |
| User Federation | Creating users automatically, how an existing user is found again, the tx_sso_* columns |
| Events | BeforeUserCreationEvent and BeforeUserDataUpdatedEvent |
| Reverse Proxy | Running behind TLS termination, and the failure it causes when misconfigured |
| Logging | Rejected logins in sys_log, technical detail in the PSR-3 logger |
| Local Development | DDEV with KeyCloak, the example realm, troubleshooting |
Where to Start
Setting it up for the first time? Read Installation end to end and walk the production checklist before you call it done. Two of its items decide whether anybody can log in at all, and one decides whether you can still get in when the identity provider is down.
Upgrading to 2.0.0 with frontend SSO in use? Go straight to Frontend Login. The extension no longer renders the SSO button for you; your own Login.html does, and a site that relied on the shipped partial has a broken login page until it is updated.
Logins fail and the login form just comes back? That is the normal symptom of every SAML problem, because nothing is shown on screen. Logging says where the reason is recorded, and Reverse Proxy covers by far the most common cause.