We have this JSON web service GET https://api.my-domain.com/accounts/me (and a bunch of other endpoints). It takes a token in the header. When that token is valid it will return

  "email": "[email protected]"

That JSON web service is used by a web application. That web application links their users to a Drupal forum. We don't want them to log in again.

The simplest solution we could think of is to link the users to:


The Challenge

Our challenge is for our Drupal instance to:

  1. Read that token from the URL https://drupal.my-domain.com?token=123456789
  2. Call our web service GET https://api.my-domain.com/accounts/me with header Authorization: token 123456789
  3. If it responds with a status 200 response and {"email": "[email protected]"}, have Drupal pick up the email value.
  4. Drupal matches it against the drupal users.
  5. When the user doesn't exist in Drupal, it has to be created.
  6. And the user is logged (SSO) into the Drupal forum.
  7. No login form was ever shown. The token was either correct (status 200 from the web service) or incorrect (status 403 or whatever) and some drupal node/page should show that an invalid token was used accessing the forum.

I have done some investigation but none of the solutions that I found quite matched this use case. Most show how to build a module and have the login form check against an external system. We don't need the form. Just a token in the url validated without a form. I don't want to build a fully fletched CAS-Server, OpenID or OAuth2 provider at the web service. We'd like to keep it simple and just verify one token in the URL against our web service.

Can we use a module for this? And how would the simplest version of this module look like?

  • I don't get it ... if such url with (say) ...?token=797204 is entered, then what do you want to happen ... in Drupal? Or am I completely wrong (there is no such URL entered at all)? Commented Nov 16, 2017 at 20:36
  • I updated the question in an attempt to be more specific about what I want Drupal to do. Commented Nov 16, 2017 at 20:46
  • merci for the clarification! Interesting challenge though ... good luck! Commented Nov 16, 2017 at 21:00

1 Answer 1


So, I don't have a working solution for this (yet!) but I'm working on a similar use case. From what I've read, you can't really have an authenticated user do anything on a Drupal site without passing them through the user module, creating a user, and storing info about them in the database.

I believe you need to write a module that passes a user object based of the email in your json response to user_external_login_register passing in some sort of programmatically populated dummy text for the extra fields you need, and then programmatically create the user and log them in in the background. In theory, all you need to do is pass the user object based off of your 200 response, and proceed to create and log the user in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.