0

Sidenote, already seen this page, doesn't seem to help: How to create user with role(s) through REST service?

I've setup a new endpoint on my platform to try to allow a 3rd party to create users on the site, I've connected it up and I'm testing it out through a REST client on Firefox. So far it seems to be working fine with the exception of applying the role to the new account.

According to the link pasted above, it needs to be set to:

{
  "name": "rest_user_1",
  "mail": "rest_user_1@test.com",
  "pass": "abc123",
  "status": "1",
  "roles": [
    "5",
    "6"
  ]
}

But that doesn't work, I've got the debugger enabled, and I can see from the response it seems to be coming back with this

Array
(
    [0] => Array
        (
            [name] => rest_user_1
            [mail] => rest_user_1@test.com
            [pass] => abc123
            [status] => 1
            [roles] => Array
                (
                    [0] => 5
                    [1] => 6
                )

        )

)

To me it looks like it's assigning the role IDs (5/6) as the values in an array, rather than the keys, so instead I tried writing my body in a different way:

My body at the moment is:

{
  "name": "rest_user_2",
  "mail": "rest_user_2@test.com",
  "pass": "abc123",
  "status": "1",
  "roles": {
    "5": "Role 1",
    "6": "Role 2"
  }
}

And the response in the log messages looks like:

Array
(
    [0] => Array
        (
            [name] => rest_user_2
            [mail] => rest_user_2@test.com
            [pass] => abc123
            [status] => 1
            [roles] => Array
                (
                    [5] => Role 1
                    [6] => Role 2
                )

        )

)

Which looks like exactly what I'd expect, but yet, still it hasn't applied the roles to my account. Can anyone help?

  • And you have read this comment, The user performing the action MUST have "administer users" and "administer permissions"? – user72672 Jul 4 '19 at 11:10
  • @Jdrupal, which user role does that need to be added to though? – Andrew Morris Jul 4 '19 at 11:27
  • The user role that shall be able to create users via the REST endpoint. – user72672 Jul 4 '19 at 11:28
  • @Jdrupal, I think I'm probably missing a step in the whole process then, I'm not particularly familiar with services in general, because at the moment that means applying that access to anonymous users, which is definitely wrong. – Andrew Morris Jul 4 '19 at 11:43
  • It sounds wrong to me that you will give anonymous users permission to create users on your site, is that correct? In that case everybody could create an administrator and then login as an administrator and crash the site. Only trusted users should be able to create users and define their roles. – user72672 Jul 4 '19 at 11:45
1

For other people reaching this post, the answer to this is to use some kind of authentication on the REST endpoint, that only allows trusted users to create new users.

Otherwise anonymous users would be able to create admins and crash the site.

So this code is correct,

"roles": [
  "5",
  "6"
]

but the problem is that the user calling the endpoint has to have the administer permissions and administer users permission to be able to set roles to users.

That can be done by setting a role that has those permissions and also has permission to call the endpoint.

oAuth could be used to do that.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.