I am using D7 and implementing my own 3rd party authentication against campus LDAP by hook_form_alter()ing a user_login_form to my use own custom user_login_authenticate_validate() which eventually calls user_login_external_register(). As general examples see these blog posts for this technique:
But using this method, or even the D7 LDAP module; I see Drupal eventually calls user_login_external_register() with $username and $password.
I dont want to store ANY $username or $password in Drupal as this is considered private student campus data. So, can anyone suggest a mechanism provide dummy user $username and $password for thousands of users logging in? What can I stuff into $username or $password to be able to know that if a student logs in 2 weeks from now they have the same Drupal account they used 2 weeks ago.
All I can think of is generating thousands of custom PHP uniqid()'s and provisioning 1 per each user just prior to calling user_login_external_register() by stuffing faux $username and $profile into the $edit or $account before Drupal creates the account and after the authenication by the 3rd party.
Any feedback and thoughts appreciated.