0

I see several modules that allow oauth2/oicd/saml login to the Drupal website (my id provider allows any of the above). I am looking for different setup, I would like to configure the site so that only specific routes are protected by the oauth2/oicd/saml, not using it for general authentication, but specific paths and routes. How can I set this up in Drupal 9? Is there a module that supports this functionality?

Desired Scenario Faculty member wants to access a particular form on the website, they go to /secure/webformXYZ and are directed to authenticate with the campus security system and then returned to the page, NO ACCOUNT IS CREATED FOR THE PERSON, but they have access to that page because the returned attributes indicate that are a faculty member (and optionally, the values returned from the authentication are used to prefill the form). People who access anywhere else on the site are not encumbered by needing to login, nor is our system crowded with unneeded accounts from the faculty who did access one of those many forms.

Improve this question
2
  • I’ve thought about this since you posted it. We use SAML 2 extensively and a Drupal site can actually authenticate against its internal database concurrently. So, are you asking if you can restrict some content to people who authenticated with federated login, or, do you want to authenticate people to a certain system based on the initial content they are trying to access? Or both?
    – cilefen
    Oct 17, 2022 at 23:21
  • Thank you for your response, see my updated question for more info.
    – Kevin Finkenbinder
    Oct 18, 2022 at 15:19

2 Answers 2

Reset to default
0

Use the SimpleSAMLphp Auth module. In its settings select "Allow authentication with local Drupal accounts" and in the "Automatic role population from simpleSAMLphp attributes" configuration use any of the attributes sent by the identity provider to assign a role or roles to the authenticated users.

Now that the users have distinguishing roles use a role-based access control on the content, like Content Access.

Improve this answer
1
  • See updated question, we don't want to have these people get access to the entire website, nor to have accounts created for them, we just want them verified before they access particular forms and/or pages.
    – Kevin Finkenbinder
    Oct 18, 2022 at 15:20
0

For anyone facing a similar situation, I was unable to find a way to make this work without writing a custom module, I was however able to use Apache's mod_auth_openidc to secure the paths in question.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.