1

I'm working on a Drupal site which is utilizing the simpleSAMLphp_auth module. We want users to be able to log in using their Gmail accounts, so long as they have an pre-existing Drupal account to match. If it turns out they do not, I don't want them being authenticated.

As of now, when I attempt to use the federated login through Gmail, it seems to authenticate me because it doesn't complain at all about access being denied. It simply takes me back to the homepage of our Drupal website.

How can I check if I am actually being authenticated, even though the email I am testing with the federated login does not have a pre-existing Drupal account associated with it?

Also, I am using the email as the simpleSAML attribute for the users unique identifier and for their email as well.

0

There are hooks and config in the module UI that should aid in this. Here is an example from a Drupal 8 project I did that does just this:

/**
 * Implements hook_simplesamlphp_auth_allow_login().
 */
function MYMODULE_simplesamlphp_auth_allow_login(array $attributes) : bool {
  // Debugging purposes
  \Drupal::logger('mymodule')->log('info', 'Attributes contained: @attributes', ['@attributes' => $attributes]);

  if (empty($attributes['EMAIL_ATTRIBUTE_IDENTIFIER'])) {
    \Drupal::logger('mymodule')->log('info', 'Attribute was not present.', ['@attributes' => $attributes]);
    return FALSE;
  }

  // Run a query to see if the user exists by email address in Drupal
  $exists = // query users by email address

  return $exists;
}

Perhaps a simpler approach in your case would be hook_form_alter, adding a new submit handler and doing the email check there before anything else happens, but the hook above is the final say-so in if a user can authenticate and login or not.

  • Would I have to write a custom module in order to implement a function similar to your own, or can I sneak it into the simplesaml module code? – GL007 Oct 10 '18 at 12:13
  • Don’t edit code that is not your own. Create a module. That’s why this hook exists. It’ll wind up being less than 25 lines of code. – Kevin Oct 10 '18 at 12:43
  • Alright, thanks. I'm gonna go ahead and try this out. – GL007 Oct 10 '18 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.