Override login module to initiate SSO redirect

Question

I have SSO working with an external IdP on my Joomla4 site.

However, to initiate a login by a user, they have to click a button/link to be directed to the IdP login form.

When I set the permissions for an article or menu item to a role like registered, a non-authenticated user attempting to access that resource is automatically redirect to the the Joomla default login form.

What I'd like is to keep that Joomla redirection functionality but to override the module so that the user is redirected to the IdP instead of the default form.

Does anyone have a best practice for overriding where the login module redirects the user to provide credentials?

I have been using Joomla since v1.5 and done many customizations but have never had to update the login module before.

EDIT The best practices I'm looking for refer to "where" to place an inturrupt in Joomla.

For example, one could possibly edit the authorize function in libraries/src/Application/SiteApplication.php, or possibly even in $menus->authorize.

The least-complicated way seems to be to override the default_login and default_logout template pre-processor in com_users/tmpl/login. Using this I could possibly force a header redirect but this doesn't might open up a risk of people posting directly to login and bypassing my OAuth IdP (but that can be addressed by blocking direct registration).

Anyway, I'm seeking advice from someone with understanding of how J4's authorization is applied and where the most effective aggregation point could be to place this redirection override that is also compatible with upgrades.

Answer 1

You are right in that this should not be done in a layout override since it can be easily circumvented. But also you should not hack core classes. Instead use system plugins. The event used should be no later than onAfterRoute. There are many different ways to do something like this using a plugin.

The simplest way could be to perform a redirect during onAfterRoute depending on input variables. For instance, to redirect all com_users frontend component pages elsewhere:

use Joomla\CMS\Plugin\CMSPlugin;

class PlgSystemExample extends CMSPlugin
{
    protected $app;

    public function onAfterRoute()
    {
        if (!$this->app->isClient('site'))
        {
            return;
        }
    
        $input = $this->app->getInput();

        if ($input->get('option') === 'com_users')
        {
            $this->app->redirect(/** YOUR URL */);
        }
    }
}

You can add additional conditions here to allow certain pages and tasks, such as user profile editing. Be aware, that if redirect URL was to end up redirecting back to com_users (e.g. if it had restricted access level), you'd end up in an infinite loop.

Another solution is to add custom routing rules. This should be done earlier, during onAfterInitialise event. In this case custom build rules could be used to rewrite URLs of one component to another. Unfortunately, this method does not seem to allow changing the host or anything other than path and query variables. Which could be very useful in your case and in general. You can see an example in this answer.

Third and most complex solution would be to override Users component MVC. This is detailed in this answer.