I'm developing the main website (A) for an organisation in D7 but for other reasons there are microsites (B) related to this website using CMSs.

I need to give this other users an endpoint in which they can check if the user and password given to them are correct in my drupal instance and of course be able to verify the request only comes from a trusted source (in another physical server without a fixed IP)

So this would be something like:

  1. User enters credentials in website B
  2. Website B's server sends those credentials to my endpoint (A)
  3. Website A check if they are correct and return either ok and the role that user has or error is there's no user matching them

I looked into Open ID and OAuth approaches but those require user interaction and rely on the users authorizing, etc. What we need is to make it all transparent to the end user so they don't have to know in which of the CMS he/she is in and make an authorization for each one.

  • You should specify the version of the drupal installation (7 or 8) – Eyal Jan 21 '16 at 20:09
  • why don't you create a custom page with website A that check the credential you're sending through website B form using ajax? "A" should give back a json value true or false. – GwenM Jan 22 '16 at 14:53

Install and configure services module in site A, and on site B you will have to write a custom php post method,

POST http://example.com/rest/user/login

Content-Type: application/json

If the response you get from this post method is status 200 then you can verify that the username and password are matching.

Some useful resources:

Services installation doc: https://drupal.stackexchange.com/a/15718

Also found php-curl example here: https://www.drupal.org/node/1334758

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.