I seek your help and advice. By default, Drupal manages user authentification using the user module that resides in the "core/modules" and through the main Drupal Database. In my case, the user is authenticated through an external webservice, the process is as follow: 1- The user enters his credentials and click submit 2- the credentials are then sent to the webservice 3- the webservice checks the data(credentials) to the one he has in his database 4- upon validation the webservice sends a token (JWT) otherwise it sends 401 Unauthorized

PS: the admin will have normal login (through Drupal Database)

The question is how can I proceed to elaborate this process of authentification?

  • Is there some existing modules that could help with this?
  • should I override the existing user module or create a new module?

Any info will be of great help.

3 Answers 3


Remote authentication can range from moderately complex to major complex.

In general, you will need Drupal users that match your external DB users. Drupal security and coding is tied to this. The easiest way is to create users that match your remote DB and then only do authentication.

How you syncing the remote to the local can quickly add complexity.

Other things you will need to deal with are overriding the password reset functionality. Changing it in Drupal will not change it in your remote DB.

Some reference material / modules to look at:

Authentication API (incomplete)

The LDAP Project - A full featured implementation with dynamic provisioning (creates local Drupal id's if user authenticated) and other stuff.

The External Auth Module - Just ran across this. May or may not be applicable.

  • Thank You so much @CG Monroe for the guidness. I'll be sure to give the provided materials a try. Oct 19, 2017 at 10:12

You have a few options depending on what you are trying to do with your webservice.

A good tutorial I've used to set this up is http://www.mediacurrent.com/blog/using-json-web-tokens-jwt-authenticate-endpoints

It sounds like you are already successfully returning a JWT. Congrats I found that to be the difficult part between CORS and restui.

I'm using React as my front end and use this code to then store the token.

axios.post(apiLoginUrl, data, headers) .then(response => { console.log(response); let jwt = ''; localStorage.setItem(jwt, response.data.token); console.log(localStorage.getItem(jwt)); }) .catch(error => { console.log(error); }); So a breakdown of what this does is as follows. It reaches out to your end point for the JWT and then stores it in localStorage.

I would then pass the token in with each of your subsequent post requests using localStorage.getItem(jwt)

You could then pass it in with all with all posts...

So with Axios - axios.defaults.baseURL = 'https://api.example.com'; axios.defaults.headers.common['Authorization'] = localStorage.getItem(jwt); axios.defaults.headers.post['Content-Type'] = 'application/x-www-form-urlencoded';

Or with something like Apollo -

const networkInterface = createNetworkInterface ({ uri: 'http://examplesite.com/graphql' }); networkInterface.use([{ applyMiddleware(req, next) { if (!req.options.headers) { req.options.headers = {}; // Create the header object if needed. } // get the authentication token from local storage if it exists let jwt = ''; const token = localStorage.getItem(jwt); console.log(token); req.options.headers.authorization = token ? `Bearer ${token}` : null; next(); } }]); const client = new ApolloClient({ networkInterface, });

Basically the JWT becomes your Authorization part of the Post request.

Hope this helps.

To handle signing up new users your could use something like this... after exposing the user endpoint via RestUI.

handleSignup(event) { console.log("running handleSignup") event.preventDefault(); const apiSignupUrl = "http://example.com/user/register?_format=json"; const headers = { "content-type": "application/json", } let data = { "name": {"value": this.state.username}, "mail": {"value": this.state.username}, "pass": {"value": this.state.password}, "field_name" : {"value:": "Name"} } axios.post(apiSignupUrl, data, headers) .then(response => { console.log(response); if (response.data.uid.length > 0) { console.log("Awesome!"); this.handleLogin(); } else { console.log("Back to the drawing board"); } //If we return a successful creation log the user in. //handleLogin(); }) .catch(error => { console.log(error); }); };

  • Please note. I think you are talking about a Drupal based external webservice. If you are talking about a completely external webservice written in something else this won't make any sense. My apologies if that is the case. Oct 17, 2017 at 21:03
  • Unfortunately the webservice is complete PHP, However, I thank you a lot for the help. there is a lot of information that will be so useful to me. Oct 19, 2017 at 10:08

I thought to share my solution hoping it may help some of you :D

In my case all users(agents/clients) needed to be authenticated through the web service in order to have a token with which they will authenticate all their future requests.

So for the agents i used the default login form that comes with drupal and tweaked it abit (ostensibly and internally), the way i tweaked it is that before the normal authentication process of drupal's happens i made sure that the agent authenticate first via the webservice and if it goes OK i let drupal's authentication process happens otherwise i raise an exception and therfore i cut the authentication off and display a login error. As for the client that have accounts within the website and all their data reside within the webservice, i created another page that has another login form and i authenticate them through the webservice and logged them into the site using sessions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.