User anonymity while using user_external_login_register()?

Question

I am using D7 and implementing my own 3rd party authentication against campus LDAP by hook_form_alter()ing a user_login_form to my use own custom user_login_authenticate_validate() which eventually calls user_login_external_register(). As general examples see these blog posts for this technique:

blog entry 1

blog entry 2

But using this method, or even the D7 LDAP module; I see Drupal eventually calls user_login_external_register() with $username and $password.

I dont want to store ANY $username or $password in Drupal as this is considered private student campus data. So, can anyone suggest a mechanism provide dummy user $username and $password for thousands of users logging in? What can I stuff into $username or $password to be able to know that if a student logs in 2 weeks from now they have the same Drupal account they used 2 weeks ago.

All I can think of is generating thousands of custom PHP uniqid()'s and provisioning 1 per each user just prior to calling user_login_external_register() by stuffing faux $username and $profile into the $edit or $account before Drupal creates the account and after the authenication by the 3rd party.

Any feedback and thoughts appreciated.

Answer 1

Would it be sufficient to hash the username and/or password through something like sha1()?

You then wouldn't be storing campus data locally, as the hash is one way. You'd still be able to check against it later as Drupal would store the hashes.