I have a drupal site where I am customizing the login by validating credentials against an OAuth2 provider, implementing the OAuth2 password flow, basically what this module does, except I am using D8 and this is for D7


I upgraded that module to D8. It works by adding a replacing the validateAuthentication function in the #validate array of the form with an implementation that validates against the external OAuth provider. I upgraded all that to D8, but then I noticed in D8 that the login method of the UserAuthenticationController is also called to validate credentials.

So I have a couple questions

  1. These two things both do basically the same thing. Both pieces of code (UserLoginForm and UserAuthenticationController) validate against the user table in the DB. Why are both doing essentially the same thing? Are they both actually being called?
  2. I realize it would be a cleaner implementation (and more Drupal 8-like) to override the UserAuthenticationController. If my module registers the /user/login route to a different controller (provided by my module) will this override the default mapping to the UserAuthenticationController?

Thanks in advance. I am new to drupal so any help would be appreciated.

1 Answer 1


UserAuthenticationController is a service that can be used by e.g. apps and decoupled websites.

Either one or the other is used, not both.

But both use the user.auth service, which receives username and password and returns a user ID in case of a match.

So if you want to override a single place to do that, that's what you want to do. Implement a service provider in your module and switch out the class of that service definition.

  • So do I have to do anything other than this in my module's services file? Drupal isn't picking up my implementation of UserAuthInterface services: user.auth: class: Drupal\oauth2_ropc_authentication\Client\OAuthROPCUserAuthenticator tags: - { name: oauth2_ropc_authentication, priority: 101 }
    – jeff.eynon
    Sep 11, 2017 at 15:10
  • That's not how it works, this is not a pluggable backend. There is one service, named user.auth and you have to override that. See drupal.org/docs/8/api/services-and-dependency-injection/… or previousnext.com.au/blog/…
    – Berdir
    Sep 11, 2017 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.