---
title: Documentation
url: "https://b13.com/products/single-sign-on-for-typo3/documentation"
date: 2026-09-10
modified: 2026-11-10
---

# Documentation

![Icon featuring a key and overlapping squares, symbolizing security or access control.](https://b13.com/fileadmin/_processed_/0/a/csm_sharing-ext-SingleSignOn-S_512e772865.webp)

  Documentation
===============

 TYPO3 Module “Single-Sign-On”
 Version 2.0.3 (04 Nov 2026)

   Chapters of this Documentation        This extension makes TYPO3 a SAML 2.0 service provider. Editors and frontend users authenticate against an external identity provider—Microsoft Entra ID, KeyCloak, ADFS, or anything else that speaks SAML 2.0—and TYPO3 accepts the resulting assertion instead of a password.

Backend and frontend are separate service providers with their own entity IDs and their own configuration source, and either can be used without the other. Nothing happens until you point one of them at an identity provider: installing the extension alone changes no login screen.

   Compatibility
---------------

TYPO3 v13.4 LTS and v14.3, PHP 8.3 or later. The `ext-simplexml` PHP extension is required because identity provider metadata is read as XML. SAML itself is handled by `onelogin/php-saml` 4.x, which is pulled in as a dependency.

Release notes live in the [changelog](https://b13.com/products/single-sign-on-for-typo3/changelog).

   Contents
----------

| Chapter | What It Covers |
|---|---|
| [Installation](https://b13.com/products/single-sign-on-for-typo3/documentation/installation) | Certificates, environment variables, extension settings, registering the app at the identity provider, endpoints, production checklist, smoke test |
| [Configuration](https://b13.com/products/single-sign-on-for-typo3/documentation/configuration) | Every configuration key, its default, and where it has to be set |
| [How It Works](https://b13.com/products/single-sign-on-for-typo3/documentation/how-it-works) | The request flow of a login and a logout, `?logintype=sso` and `?logintype=slo` |
| [Backend Login](https://b13.com/products/single-sign-on-for-typo3/documentation/backend-login) | The provider switch, `enforceSSO`, the Install Tool as the way back in |
| [Frontend Login](https://b13.com/products/single-sign-on-for-typo3/documentation/frontend-login) | The contract with your own `Login.html`, `redirect_url`, `enforceSSO` per site |
| [User Federation](https://b13.com/products/single-sign-on-for-typo3/documentation/user-federation) | Creating users automatically, how an existing user is found again, the `tx_sso_*` columns |
| [Events](https://b13.com/products/single-sign-on-for-typo3/documentation/events) | `BeforeUserCreationEvent` and `BeforeUserDataUpdatedEvent` |
| [Reverse Proxy](https://b13.com/products/single-sign-on-for-typo3/documentation/running-behind-a-reverse-proxy) | Running behind TLS termination, and the failure it causes when misconfigured |
| [Logging](https://b13.com/products/single-sign-on-for-typo3/documentation/logging) | Rejected logins in `sys_log`, technical detail in the PSR-3 logger |
| [Local Development](https://b13.com/products/single-sign-on-for-typo3/documentation/local-development-with-ddev-and-keycloak) | DDEV with KeyCloak, the example realm, troubleshooting |

   Where to Start
----------------

**Setting it up for the first time?** Read [Installation](https://b13.com/products/single-sign-on-for-typo3/documentation/installation) end to end and walk the [production checklist](https://b13.com/products/single-sign-on-for-typo3/documentation/installation#c12332) before you call it done. Two of its items decide whether anybody can log in at all, and one decides whether you can still get in when the identity provider is down.

**Upgrading to 2.0.0 with frontend SSO in use?** Go straight to [Frontend Login](https://b13.com/products/single-sign-on-for-typo3/documentation/frontend-login). The extension no longer renders the SSO button for you; your own `Login.html` does, and a site that relied on the shipped partial has a broken login page until it is updated.

**Logins fail and the login form just comes back?** That is the normal symptom of every SAML problem, because nothing is shown on screen. [Logging](https://b13.com/products/single-sign-on-for-typo3/documentation/logging) says where the reason is recorded, and [Reverse Proxy](https://b13.com/products/single-sign-on-for-typo3/documentation/running-behind-a-reverse-proxy) covers by far the most common cause.