I have SSO working with an external IdP on my Joomla4 site.

However, to initiate a login by a user, they have to click a button/link to be directed to the IdP login form.

When I set the permissions for an article or menu item to a role like registered, a non-authenticated user attempting to access that resource is automatically redirect to the the Joomla default login form.

What I'd like is to keep that Joomla redirection functionality but to override the module so that the user is redirected to the IdP instead of the default form.

Does anyone have a best practice for overriding where the login module redirects the user to provide credentials?

I have been using Joomla since v1.5 and done many customizations but have never had to update the login module before.

EDIT The best practices I'm looking for refer to "where" to place an inturrupt in Joomla.

For example, one could possibly edit the authorize function in libraries/src/Application/SiteApplication.php, or possibly even in $menus->authorize.

The least-complicated way seems to be to override the default_login and default_logout template pre-processor in com_users/tmpl/login. Using this I could possibly force a header redirect but this doesn't might open up a risk of people posting directly to login and bypassing my OAuth IdP (but that can be addressed by blocking direct registration).

Anyway, I'm seeking advice from someone with understanding of how J4's authorization is applied and where the most effective aggregation point could be to place this redirection override that is also compatible with upgrades.

  • 1
    Are you able to make a start with how you think this custom development would be crafted? Offering your best attempt will make this question look less like asking for free work to be done. Even pseudo code will be a step in the right direction -- it would help to indicate that you might know which classes to involve. Commented Sep 25, 2022 at 21:34
  • 1
    @mickmackusa sure; I've updated the ask. Since security, especially in joomla, is so utterly complex, I'm looking for advice on best practices, not actual code to be written.
    – Lance
    Commented Sep 26, 2022 at 1:53

1 Answer 1


You are right in that this should not be done in a layout override since it can be easily circumvented. But also you should not hack core classes. Instead use system plugins. The event used should be no later than onAfterRoute. There are many different ways to do something like this using a plugin.

The simplest way could be to perform a redirect during onAfterRoute depending on input variables. For instance, to redirect all com_users frontend component pages elsewhere:

use Joomla\CMS\Plugin\CMSPlugin;

class PlgSystemExample extends CMSPlugin
    protected $app;

    public function onAfterRoute()
        if (!$this->app->isClient('site'))
        $input = $this->app->getInput();

        if ($input->get('option') === 'com_users')
            $this->app->redirect(/** YOUR URL */);

You can add additional conditions here to allow certain pages and tasks, such as user profile editing. Be aware, that if redirect URL was to end up redirecting back to com_users (e.g. if it had restricted access level), you'd end up in an infinite loop.

Another solution is to add custom routing rules. This should be done earlier, during onAfterInitialise event. In this case custom build rules could be used to rewrite URLs of one component to another. Unfortunately, this method does not seem to allow changing the host or anything other than path and query variables. Which could be very useful in your case and in general. You can see an example in this answer.

Third and most complex solution would be to override Users component MVC. This is detailed in this answer.

  • Thanks Sharky; very much appreicated. I'll try a couple of these. I am completely removing any usage of com_users for authentication, profile, or registration. I'm relying solely on the IdP for authentication and profile management, but will continue to use J4 for the authorization based on group-matching, so overriding the user mvc might actually prove the most useful.
    – Lance
    Commented Sep 26, 2022 at 19:19
  • Sharky are you aware of which joomla event is responsible for evaluating the default RBAC of each page load?
    – Lance
    Commented Sep 30, 2022 at 14:13
  • 1
    I don't think there are any authorization events. As you've already examined, access for current page is checked in application's authorise() method which is called right after onAfterRoute event is dispatched.
    – Sharky
    Commented Oct 3, 2022 at 6:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.