Problem/Motivation

The Client Secret is displayed in the Drupal admin interface. This is potentially a security issue.

I know there is a way to put the value in the settings.php file instead but we have not been able to get that to work.

Proposed resolution

We also use the Microsoft Entra ID SSO Login module. This allows you to enter the Client Secret but afterwards the field is empty and the secret is not displayed. See attached screenshot.

User interface changes

Use the same methodology as the Microsoft Entra ID SSO Login module.

CommentFileSizeAuthor
Screenshot 2026-03-23 141617.jpg20.23 KBsimon-p

Comments

simon-p created an issue. See original summary.

  • robbymo committed 7b771774 on 1.0.x 
    Issue #3581061: Secret value changed from text to password field and...
robbymo’s picture

robbymo commented
Assigned: Unassigned » robbymo
Status: Active » Fixed

Thank you for pointing this out simon-p! The configuration form has been updated to no longer show the stored secret value. Since things are stored as configuration just be aware that anyone who has access to configuration files / config sync will be able to view the stored value.

For the settings.php file, I just validated on 10.6.5 and 11.3.5 that the overrides work as expected. In the documentation it uses environment variables but you can put anything in as test values:

$config['sharepoint_connector.settings']['client_id'] = "testclient";
$config['sharepoint_connector.settings']['client_secret'] = "testsecret";
$config['sharepoint_connector.settings']['tenant_id'] = "testtenant";
$config['sharepoint_connector.settings']['host'] = "testhost";

This uses the global $config variable, so for any non-blank value set here you should see the corresponding configuration field on the main settings page become disabled / grayed out. That lets you know that it is picking things up as expected and will be passed on during function executions. We've had some users run into issues setting up their env vars where the env var was set and visible on the host machine OS but the web server (i.e. Apache) was not picking it up and utilizing it in PHP.

Feel free to reach out if you need any further assistance with this. Cheers!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

simon-p’s picture

simon-p
Primary language English
Location Vancouver
commented

Thanks Rob for the fast update.

Yes, we realise the value will still be stored in the database, but at least that having it in the database provides a further level of protection from the Drupal interface. We'll give using the settings.php file another go.

Thanks again.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.