I want to implement some additional validation steps right after a user has logged in to a Drupal site.

So far, I have implemented the additional validation inside hook_user_login. If the validation fails, I am forcing the logout by calling user_logout.

EDIT: Part of the users are authenticated through an external SSO, so altering the login form to add an additional validation does not seem to be a good solution.

Is this the most standard way to do it, or is there a better way?

  • What are you validating ? Some inputs from the register form or login ?
    – pbonnefoi
    Jan 28, 2015 at 10:33
  • I am validating the username against an ad-hoc service implemented somewhere else. It just gives a "Go - NoGo" response. I need to abort the login in case the response is "NoGo".
    – dinopmi
    Jan 28, 2015 at 10:42

3 Answers 3


If You want to abort login I think You should try to add own validate function to user_login whith hook_form_alter (https://api.drupal.org/api/drupal/modules!system!system.api.php/function/hook_form_alter/7)

 * Implements hook_form_alter().
function MYMODULE_form_alter(&$form, &$form_state, $form_id) {
  if ($form_id == 'user_login') { // or $form_id = 'user_login_form'
    $form['#validate'][] = 'check_username_against_ad_hoc_service';

function check_username_against_ad_hoc_service($form, &$form_state) {
  $name = $form_state['values']['name'];

  if($name == 'NoGo') {
    form_set_error('name', 'You're an Ad-hoc!');

You can also use function hook_form_FORM_ID_alter (https://api.drupal.org/api/drupal/modules!system!system.api.php/function/hook_form_FORM_ID_alter/7)

  • Thanks for the reply! Unfortunately, many of the logins to the site are coming from SSO, so altering the login form would not be enough. I am editing my original post to reflect this.
    – dinopmi
    Jan 28, 2015 at 12:32

As mentioned, you could add a #validate in hook_form_user_login_form_alter() and just set a form error.

However, if you're validating against an external service and perhaps getting user info from that endpoint, the 'most standard' way is probably to use user_external_login_register().


Thanks Marcin and skh for your answers. Unfortunately, it seems my case is quite specific. I will post below my solution in case someone else has a similar situation:

NOTE: This solution assumes the site is receiving logins not coming from the standard login form. If all the logins are coming through the standard login form, it is much better to add a #validatein hook_form_alter, as mentioned above.

If logins to the site come from different places (such as SSO), my solution has been to implement hook_user_login:

function MYMODULE_user_login(&$edit, $account) {
  $additional_validation_result = MYMODULE_additional_validation($account);
  if ($additional_validation_result === TRUE) {
    // Additional validation passed. Just return
  else {
    // Additional validation failed. Force logout
    module_load_include('pages.inc', 'user');

Comments and improvements are welcome.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.