I want to create new accounts only if user name and password have matched with that of with Active Directory.

So if a completely new user tries to login and enters correct Active Directory login & password then I'm adding him/her using user_save in the form validator.

But at the same time I'm returning with error that "please re-login".

However I want a seamless login. That is if a new user tries to login -- I'll create a new user and at the same time he/she should also be logged in.

How can I do this?

3 Answers 3


I had a similar use case in the past and i am giving some snippet, hope will help you. The key was user_login_finalize and then redirecting internally to the same page.

Load the user if already present or create and then load him

$user = user_load_by_name_and_password($username, $password);
if ($user == FALSE) {
  $newuser = array(
    'name' => $username,
    'pass' => $password, // some password
    'mail' => $email, // some email
    'status' => 1,
    'init' => $email, // some email id
    'roles' => $roles, // some roles
  // New user is saved and loaded
  $user = user_save(drupal_anonymous_user(), $newuser);

http://api.drupal.org/api/drupal/modules!user!user.module/function/user_login_finalize/7 Finalize the login process. Must be called when logging in a user

drupal_goto must be called as user_login_finalize() bootstraps the currently logged in user too late and hence will throw 'access denied' even for the page for which the user has permission. drupal_goto() makes sure that the user is properly bootstrapped and then is made to access the page again.

It is equivalent to reloading the page after the user has logged in but this is the only way i got my external login work. Refer User login using a token or ID (no password)

  • In which hook do I need to place this code?
    – AgA
    Jun 11, 2014 at 11:13
  • In your case make it as a function, say sso, and invoke it at login form validation. I had used it for Single-Sign-On with master website and hence i had to call it in init hook since the user could enter the website through any page, and hence i checked if the user was logged in or not at the entry itself and called sso function accordingly. You may also do a similar thing - dont call sso on unprotected pages but redirect to login page from protected pages and invoke sso function on form validation.
    – Ranjan
    Jun 11, 2014 at 11:48

I wrote a simple module to do this: first I alter a user_login form and add my function to it's validation functions. on my validate function I check if username/password combination is correct,if not I check if username is not existed and then I create new user with that combination and regenerate a session to login this user,then redirect to '/user'.now user is logged in.but there is a error saying "Sorry, unrecognized username or password. Have you forgotten your password?" to clear errors I called drupal_get_messages() function and set my custom message to welcome user.

//implement hook_form_FORM_ID_alter
function MODULENAME_form_user_login_alter(&$form, $form_state, $form_id) {
    if ($form['#form_id'] == 'user_login') {
        $form['#validate'][] = 'MODULENAME_login_validate';

function MODULENAME_login_validate($form, &$form_state) {
    $username = $form_state['values']['name'];
    $password = $form_state['values']['pass'];
    $user = user_authenticate($username, $password);
    $roles = array(2); // authenticated user role id,you can set other roles here
    if ($user == FALSE && !user_load_by_name($username)) { /* and other validation you want for username-passwors structures */
    $acc = array(
        'name' => $username,
        'pass' => $password,
        'mail' => $username . '@dummy.com',
        'status' => 1,
        'roles' => $roles, // some roles
    // New user is saved and loaded
    $account = user_save(drupal_anonymous_user(), $acc);
    global $user;
    $user = $account;
    drupal_session_regenerate(); // regenerate a session to login a user
    drupal_get_messages(); // to clear error message generated by user login form
    drupal_set_message('Welcome'); // or other message you want

I've implemented it using JQuery. So if anybody presses Submit button after entering login & passwd then I send an Ajax request and in the back-end module I receive the login & passwd, check it in the Active Directory, if verified then create a new user and send success to the front end, which then submits the form and user is able to login(without even registering).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.