SSO Connector Autologout

Makes the contributed Autologout module aware of a federated SSO session. On each authenticated request it asks the SSO Connector Cookie service to cryptographically validate the shared SSO cookie; only then does it refresh Autologout's idle-activity marker. A user who is active elsewhere in the SSO network is therefore not logged out here, while idle and maximum-lifetime timeouts remain genuinely enforced.

Features

• Refreshes the Autologout idle timer only while a cryptographically valid SSO cookie is present — a merely present or forged cookie never extends the session.
• Runs before the contributed Autologout subscriber.
• Falls back to the contributed timeouts unchanged when the cookie submodule is absent.
• Idle and absolute maximum-lifetime timeout enforcement.
• Optional signed, cross-site activity cookie (HMAC-verified) to share recent activity across the network.
• Open-redirect-guarded logout destination, validated both at runtime and at save time.

Requirements

• Drupal core ^11.2 || ^12
• Autologout ^1.0 (required)
• SSO Connector ^1.0
• Recommended: SSO Connector Cookie to prove the SSO session

Installation

composer require drupal/sso_connector_autologout
drush en sso_connector_autologout

Part of the SSO Connector bundle

Requires SSO Connector (core) and the contributed Autologout module. See the core project for the full suite.