SSO Connector Autologout
This module prevents users from being logged out of Drupal prematurely when they have an active single sign-on (SSO) session. It integrates with existing autologout settings to ensure users remain logged in as long as their SSO session is valid, improving the experience in multi-site SSO environments.
Makes the contributed Autologout module aware of a federated SSO session. On each authenticated request it asks the SSO Connector Cookie service to cryptographically validate the shared SSO cookie; only then does it refresh Autologout's idle-activity marker. A user who is active elsewhere in the SSO network is therefore not logged out here, while idle and maximum-lifetime timeouts remain genuinely enforced.
Features
- Refreshes the Autologout idle timer only while a cryptographically valid SSO cookie is present — a merely present or forged cookie never extends the session.
- Runs before the contributed Autologout subscriber.
- Falls back to the contributed timeouts unchanged when the cookie submodule is absent.
- Idle and absolute maximum-lifetime timeout enforcement.
- Optional signed, cross-site activity cookie (HMAC-verified) to share recent activity across the network.
- Open-redirect-guarded logout destination, validated both at runtime and at save time.
Requirements
- Drupal core
^11.2 || ^12 - Autologout
^1.0(required) - SSO Connector
^1.0 - Recommended: SSO Connector Cookie to prove the SSO session
Installation
composer require drupal/sso_connector_autologout drush en sso_connector_autologout
Part of the SSO Connector bundle
Requires SSO Connector (core) and the contributed Autologout module. See the core project for the full suite.