Is there a flag or setting that can prevent Drupal from creating a new USER/PEOPLE after they login via SSO? I would like to be able to control which application can create a user if it doesn't exist via SSO. I do have an application that I don't want the user table to fill up with random users just because they login via sso.

Thanks for the hard work on this!

Comments

nomisgnos created an issue. See original summary.

batigolix’s picture

batigolix
Primary language Dutch
Location Utrecht
commented
Issue tags: +finalist-sprint

  • fabianderijk committed 71e6bca4 on 5.0.x 
    Issue #3388394: SSO to only login user who are in the People table
fabianderijk’s picture

fabianderijk
him/his
Primary language Dutch
Location Alphen aan den Rijn
commented
Status: Active » Fixed

I've just added this option to the dev branch. You now have a checkbox in the SSO settings. When enabled, only user that already have an account on the website can login with SSO. Other users will be shown a error.

  • fabianderijk committed 0f732062 on 5.0.x 
    Issue #3388394: SSO to only login user who are in the People table pt2
nomisgnos’s picture

nomisgnos commented

@fabianderijk great work! I just tested it.

I toggled it on and it didn't create an account on the website. I toggled it off and it created the account. It works as described.

I did run into a very MINOR issue which may or may not be necessary to fix...

under that same settings page /admin/config/system/o365/settings/sso

I turned ON (ticked)

"Hide the login form"
"Automatically redirect users to the SSO login page."
"Redirect after login to destination URL"
"Disable creating new users"

Then I would login with a user that DOES NOT have an account.

It creates an infinite redirect loop and it looks like the loop is coming from the callback URL but it then sends that anon sso user back to the login then probably does the cycle of redirects.

If I turn off "hide the login form" and "automatically redirect users to the SSO login page", I see the "error message" you are talking about which is great.

I think the combo of "Disable creating" and "Automatically redirect users to the SSO login page" and not having account is the issue.

Something very minor. Great work though!

nomisgnos’s picture

nomisgnos commented
Status: Fixed » Reviewed & tested by the community
batigolix’s picture

batigolix
Primary language Dutch
Location Utrecht
commented
Status: Reviewed & tested by the community » Needs work

I understand from nomisgnos comment that this could still be improved a bit. I set this ticket's status to Need Work

  • fabianderijk committed b6098988 on 5.0.x 
    Issue #3388394 by fabianderijk: SSO to only login user who are in the...
fabianderijk’s picture

fabianderijk
him/his
Primary language Dutch
Location Alphen aan den Rijn
commented
Status: Needs work » Fixed

Thanks for testing nomisgnos! I've just committed a fix for this issue. When the auto redirect option is enabled a non-existing user will be redirected to the frontpage.

Keep in mind, in some use cases this can still create a infinite loop. For instance when the frontpage itself is a page a user need to be logged in for. Maybe this is something we can improve even more in the future (like a special page that is always accessible).

nomisgnos’s picture

nomisgnos commented

I agree with @fabianderijk. I tested it and it resolves the original issue.

nomisgnos’s picture

nomisgnos commented
Status: Fixed » Reviewed & tested by the community
fabianderijk’s picture

fabianderijk
him/his
Primary language Dutch
Location Alphen aan den Rijn
commented
Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.