I am using D7 and implementing my own 3rd party authentication against campus LDAP by hook_form_alter()ing a user_login_form to my use own custom user_login_authenticate_validate() which eventually calls user_login_external_register(). As general examples see these blog posts for this technique:

blog entry 1

blog entry 2

But using this method, or even the D7 LDAP module; I see Drupal eventually calls user_login_external_register() with $username and $password.

I dont want to store ANY $username or $password in Drupal as this is considered private student campus data. So, can anyone suggest a mechanism provide dummy user $username and $password for thousands of users logging in? What can I stuff into $username or $password to be able to know that if a student logs in 2 weeks from now they have the same Drupal account they used 2 weeks ago.

All I can think of is generating thousands of custom PHP uniqid()'s and provisioning 1 per each user just prior to calling user_login_external_register() by stuffing faux $username and $profile into the $edit or $account before Drupal creates the account and after the authenication by the 3rd party.

Any feedback and thoughts appreciated.

  • Where is the function user_login_external_register defined? Do you mean user_external_login_register? If so, who calls this function with a $username and a $password? That code is wrong; user_external_login_register needs a $username and a $module.
    – Oswald
    Commented Mar 15, 2012 at 20:51

1 Answer 1


Would it be sufficient to hash the username and/or password through something like sha1()?

You then wouldn't be storing campus data locally, as the hash is one way. You'd still be able to check against it later as Drupal would store the hashes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.