I'm trying to install Drupal with Single Sign On over Active Directory.

My customer does not have any SSO suite like CAS, and their general recommendation are to use Kerberos (or NTLM as a second choice). I am clearly agreed with that.

Each time I had to integrate SSO with Active Directory using Kerberos, I use "native" product facilities, or apache mod_auth_kerb with headers rewrite.

Does someone implemented such a working module ? Everything I read about that is around "on developpement modules" on "snapshots realeases". We are currently using a ldap module that allow authentication over LDAP, and it seems that it provide SSO features, but I don't have any feedback on it.

So : Should I implement SSO over Kerberos using Apache mod_auth_kerb, or is there a real functional module that would encapsulate all those tedious configuration and dialog ?

What is the best pratice, at this moment ? Could you provide me "real" (anonymised) examples ?

As soon as I would installed it and put in in production (around the end of december), i would give you my feedback.

Thanks in advance

1 Answer 1


After some researches and tests, I finally made a choice.

In most cases, I'd prefer use native or add on features. This provide better integreation with the product (here Drupal) and it's more a Logic solution than a technical one (which is quite easier). The LDAP_SSO module allow this kind of configuration.

Nevertheless, I was not able to configure it this time, mainly due to poor debug facilities. Even with watchdog, I am not able to know what is the matter. Moreover, my customer have clear procedure to install and use Kerberos, with Apache HTTP and mod_auth_kerb. Hopefully, LDAP_SSO module allow this too.

After some tries, I will get back here to share with you more advanced comments, but at this time, we clearly go to apache+mod_auth_kerb+fowarded REMOTE_USER.

Edit a few monthes later :

That works great with Mod auth kerb on apache server and ldap module v1.0-beta12 on drupal. Even if v2.0 is available, we were facing some issues because some fields were empty and this were causing troubleshootings. But nevermind, we are able to authenticate et identify users, collect groups and map them to drupal profiles etc.

  • I am trying to configure ldap sso modul for drupal 8 currently. It looks like users are authenticated in apache logs but drupal doesn't seem to think the same. I know it's long ago since you have been at that topic but do you have any useful guides / hints maybe?
    – macbert
    Commented Apr 15, 2019 at 17:26
  • No idea at all ... sorry ... you should post another question to let community help you ... it's really too old for me. Commented Apr 17, 2019 at 18:03
  • Did that and fixed it serverfault.com/questions/963255/…
    – macbert
    Commented Apr 18, 2019 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.