Problem/Motivation

Sharepoint ID's are stored in the Drupal database, and displayed in the module settings page (although the Client Secret is left blank). If there is a website security breach these values are available to unauthorized people.

Proposed resolution

For security reasons, the Sharepoint Connector module allows the Sharepoint settings to be included in the settings.php file (see screenshot).

It would be good if that option was available for this module.

Thanks

CommentFileSizeAuthor
Screenshot 2026-03-09 095618.jpg78.52 KBsimon-p

Comments

simon-p created an issue. See original summary.

  • d49b60ca committed on 2.0.x 
    feat: #3578080 Allow settings to be in settings.php file

By: simon-p
By...
jaseerkinangattil’s picture

jaseerkinangattil commented
Assigned: Unassigned » jaseerkinangattil
Status: Active » Fixed

This feature has been implemented and released in 2.0.1.

The module now supports overriding credential settings via settings.php, consistent with how other Drupal modules (e.g. Sharepoint Connector) handle this pattern.

How to use it — add any of the following to your settings.php:

Using environment variables (recommended for production):

Or hard-coded values:

Behaviour:

  • When a credential is overridden in settings.php, the corresponding field on the settings form (/admin/config/services/entra-id/settings) is disabled and a warning notice is shown.
  • Overridden values are never written back to the database on form save.
  • The active (override-inclusive) value is shown in the disabled field so administrators can see what value is in effect.
  • Documentation has been added to the README under a new "Securing Credentials via settings.php" section.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.