1

I'm working on an Oauth2 authentication implementation where I need to provide content access to external users authenticated against an Oauth2 server which provides me with user info. From my understanding of Drupal's user system, this requires me to create a local user populated with the information provided via the API. I've been looking at the user_external_login_register function and it looks like one of the expected user fields is a password. In my case, since the users are authenticating against an external server, the only validation info I have for them is the auth token, and it would actually defeat the purpose for me to have their password. So, should I provide a dummy password?

1
+50

It depends on how you want Oauth integration to work.

If the Oauth integration is a supplement, then you should let users define a password themselves, so they can either login with username/password or Oauth. If you don't want users to login directly on the Drupal site with credentials but only use Oauth, you can use user_external_login_register. This willassign a random password to the user, since the password property is required, a random password is generated on the fly:

...
$userinfo = array(
  'name' => $name,
  'pass' => user_password(),
  'init' => $name,
  'status' => 1,
  'access' => REQUEST_TIME,
);
$account = user_save(drupal_anonymous_user(), $userinfo);
...
  • The issue is that I want to keep an existing users on their own credentials, and allow another set of users to use their own creds against the OAuth server. The existing modules all assume Drupal-to-Drupal and ask the users for their creds in the client system. That shouldn’t happen in an OAuth flow, so I’ve modified the login form to include a login link for the OAuth users that redirects them to the authentication server and then back to a page to deal with the token and getting the user info. The OAuth users don’t need a password, but I need to feed one to the user object, right? – nizz0k Mar 3 '18 at 9:50
  • But that said, I don’t see a problem with this, I’ll verify and accept later thanks! – nizz0k Mar 3 '18 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.