I'm currently creating a module which should help me manage users from 1 instance for my other multisite instances. So there will only be admins/editors and no other user logins. My goal is now to hook the user create / update function and save same datas on all other databases.

But i'm not able to bring it work.

I started with the update hook because i think it's easier. Here is module function and one of my try:

 * Implement hook_entity_update.
 * @param \Drupal\Core\Entity\EntityInterface $entity
 *   The entity object.
function my_module_entity_update($entity) {

  if($entity->getEntityTypeId() === 'user') {

    foreach ($sites as $site) {
      $siteName = str_replace(DRUPAL_ROOT . '/sites/', '', $site);
      if ($siteName !== 'default') {
          ->condition('type', $entity->getEntityTypeId())
          ->condition('id', $entity->id())


But here i get the error because the $entity->getFields() returns an object instead of an array.

How can i save the whole user entity at once including the roles and other related tables?

Do i really need to assign every single field? Or is there a hopefully easier way?

  • From an earlier question of yours, I've seen you tried LDAP first. What went wrong with this approach? It's far more feasible than trying a database level synchronisation. Dec 3, 2017 at 23:46
  • The point is that my client has no LDAP and even openLDAP needs a lot of work and think in time. The other thing is that then client has again another system where he need to manage something. So from my view point would be the easiest and fastest way to just hook in on create / update and deletion to make the same changes to the other databases, because you have all informations already and just need to "push" it. Dec 4, 2017 at 6:26
  • We had a similar request on our desks recently and went for Keycloak as external authentication provider. This won't help for the 'has another system to maintain' argument, but Keycloak is relatively easy to setup and maintain. And it probably saves you some headache trying to undermine the provided abstraction of Drupal 8's entities and service layers. Dec 4, 2017 at 7:06
  • OK thanks for that hint. How long did it take to set all up, including on Drupal site? And did you use SAML or CAS? Dec 4, 2017 at 7:31
  • Setting up Keycloak and getting it running including an LDAP upstream (you don't need that one, but our client had LDAP as well for his own staff ;), Socials Login and 2FA was done in a couple of hours. Our designers spent some days for theming the Keycloak pages to our client's wishes, and integrating it to Drupal took myself some days for getting a module production ready that is using OpenID connect. (Drupal repos, search for Keycloak.) You may contact me via my Drupal profile for the latest user role sync an SSO patches, they are still waiting for a patch of the openid_connect module. Dec 4, 2017 at 7:38

1 Answer 1


Long answer short: You can't save them at once and have to synchronize the user fields manually.

Users are fieldable entities and field data is stored in different tables. So in your case you'd have to create all fields you like to synchronize in all your sites and you need to read them from your base site's user entity field by field and write them to the according tables of your target sites.

A very error prone approach on database level (not mentioning the complexity with a growing number of attributes/client sites).

I strongly suggest a less low-level solution. E.g. by utilizing Drupal's REST services, considering OAuth2/OpenID server/client, LDAP or SAML for user authentication. (Just some keywords to use Google with; there are some contrib D8 modules in heavy development for all of these approaches.)

  • Thanks for your answer. It's not what i want to hear :D but it's what Drupal gives us. Dec 4, 2017 at 6:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.