3

My site forces users to log in with a specific OAuth provider for some reasons. Users should not be able to log in using their username and password pairs. Only the site managers can have accounts independent of OAuth.

When first creating an account with OAuth, the 'pass' field is set to an empty string ''. My first question is whether it is the right and most secure way to prevent logging in using password.

The second question is about requesting new password via email. I implemented hook_menu_alter to customize user and user/login and to unset user/password. Now users cannot access user/password, I wonder if there is a bypass for it. This question is less important since almost all users would never bother with or even know the possibility of requesting new password.

Improve this question

2 Answers 2

Reset to default
2

  1. If you disable email notification of new accounts, the OpenID module will set a random password when users register. See openid_form_user_register_form_alter(). If that is not what you want, you use hook_form_alter() to do the same thing under your desired conditions.

  2. If you want to intercept user_pass_reset() so it cannot reset passwords, try using hook_form_alter() to add a form validation function.

Improve this answer
0

This is what I did to disable Drupal's own login mechanism on Drupal 6 when I wanted to force users to log in through the Connector module instead: https://github.com/voxpelli/drupal-disabledefaultlogin

Never got around to release it on Drupal.org though and I'm not actively developing it anymore - but feel free to be inspired by it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.