I am working on a Drupal 8 site that for all intents and purposes will be used as a company intranet. I'm also using the Social Auth Google module to allow only company-registered GSuite accounts to use the site.

I have tested this module, and it works great! However, I'd like to remove the /user/login, /user/register, and /user/password routes, as well as the associated tabs (as per screenshot below), to prevent anyone using anything but the Google Social Auth login feature.


Sure, I could use CSS to hide these elements, but that doesn't feel right to me.

I'd appreciate any guidance on how to achieve this.

  • how about redirecting them?
    – cchen
    Nov 7, 2018 at 21:29
  • Be careful not to interfere with say, breaking UID 1 from logging in.
    – Kevin
    Nov 7, 2018 at 21:58
  • @Kevin: I thought about this as well, and thought of creating an unknown page and adding the User Login block into the content area of it.
    – maGz
    Nov 8, 2018 at 5:28

2 Answers 2


in a custom module that we call 'custom', have custom.services.yml with content :

    class: Drupal\custom\Routing\RouteSubscriber
      - { name: event_subscriber }

then create the file src/Routing/RouteSubscriber.php with the following :


namespace Drupal\custom\Routing;

use Drupal\Core\Routing\RouteSubscriberBase;
use Symfony\Component\Routing\RouteCollection;

 * Listens to the dynamic route events.
class RouteSubscriber extends RouteSubscriberBase {

   * {@inheritdoc}
  protected function alterRoutes(RouteCollection $collection) {
    // Always deny access to unwanted routes.
    $disallow_routes = [
    foreach ($disallow_routes as $disallow_route) {
      if ($route = $collection->get($disallow_route)) {
        $route->setRequirement('_access', 'FALSE');


enable the 'custom' module and this should work :)

  • Brilliant! Thank you, izis. I learnt something new
    – maGz
    Nov 9, 2018 at 11:25
  • @izus It worked, but I do not want to disable login completely. I want to make it secure. I have installed key auth module which provides a unique key for every user. That key is used for authentication like this example.com/user/login?api-key=(unique_user_key) So I want to allow user to login using this link. How can I do it? If you have better suggestions, please share it with me.
    – Umair
    Jul 14, 2021 at 17:30

You could disable the login page with the Disable Login Page module. This will disallow accessing the login page without the required key value pair in the querystring.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.