I have a requirement to replace the default user authentication with the authentication of a central server, i.e., the SSO server.
By debugging Drupal, I learned that all the session management happens in the includes/session.inc
file. I want to do authentication as shown in the image:
SCENARIO: Login
The details of the steps would be as follows:
- Replace the login form to submit the username and password to the SSO server (not on Drupal, but on .NET).
- Authenticate the user on the SSO server using that site's database, and send a response back to some custom PHP page of my website (or a form by a module?).
- Using the response, identify the user in the users table, and create a session for that user without checking for the password (as it would mean double authentication). By default, Drupal sets a cookie with the name of the
$insecure_session_name
variable and the value$sid
. I want Drupal not to set the cookie here but instead send the values of variables to the SSO server. - The SSO server will take the values, create a cookie, and drop it in the domain
domain.com
(to remind bothmy website
andsso server
are on the subdomain of the main domain, which is not in Drupal). Then, the drupal site can log in by using that cookie.
I know it is a tough ask, but I am just looking for pointers on how to start. as they say, "you should not hack the core". So, my questions are:
- Where should I look to understand how Drupal authentication and session management works in depth?
- Is there a way I could call the functions in
includes/session.inc
using hooks (as the comments with functions say "for internal use only/not to be modified")?
NOTE: I'll be using the same method to register the user so that the record remains in the central database of the SSO server. And during that will put in some junk password for the same user in the Drupal site's database (as the password will not be checked during login).