I'm working on an Oauth2 authentication implementation where I need to provide content access to external users authenticated against an Oauth2 server which provides me with user info. From my understanding of Drupal's user system, this requires me to create a local user populated with the information provided via the API. I've been looking at the user_external_login_register function and it looks like one of the expected user fields is a password. In my case, since the users are authenticating against an external server, the only validation info I have for them is the auth token, and it would actually defeat the purpose for me to have their password. So, should I provide a dummy password?
It depends on how you want Oauth integration to work.
If the Oauth integration is a supplement, then you should let users define a password themselves, so they can either login with username/password or Oauth. If you don't want users to login directly on the Drupal site with credentials but only use Oauth, you can use
user_external_login_register. This willassign a random password to the user, since the password property is required, a random password is generated on the fly:
... $userinfo = array( 'name' => $name, 'pass' => user_password(), 'init' => $name, 'status' => 1, 'access' => REQUEST_TIME, ); $account = user_save(drupal_anonymous_user(), $userinfo); ...