I would like to authenticate a user which exists in an external site.

Here is a use case:

  1. In Drupal, user enters his username and password and hits submit.
  2. Drupal tries to find that user in it's system and does not find him. At this point an error message is still premature.
  3. Drupal then runs a custom function which does a REST call to an external site. The REST call validates the username and password.
  4. If the username and password pair is valid, the REST call returns a success code.
  5. I then log him in.

Is this possible? If so, how? What hooks do I need to implement? What method should I call to log a person in?

I can programmatically log a user in via

$form_state['uid'] = <user_id>;
user_login_submit(array(), $form_state);

but user_id needs to exists in Drupal for this piece of code to work.

I am using Drupal 7.


  • Similar question: drupal.stackexchange.com/questions/29917/…
    – mpdonadio
    May 16, 2012 at 19:11
  • Yes. But to be fair no decent answer seems to have been given in that post. May 16, 2012 at 19:25
  • 2
    I think my answer is pretty decent. It isn't code for you to use, but it is an excellent starting point.
    – mpdonadio
    May 16, 2012 at 19:32
  • Allow me to politely disagree. Although you did post an answer on above link, it is merely a reference to a module that achieves similar goal. It is indeed a helpful place to start, but obviously the currently posted question can be added upon seeing as to how the original poster you linked to did not quite seem totally satisfied by the answer you posted. I was seeing more a service based approach using callback mecanism of form_alter, and would be interested in seeing other ideas on this. In your approach, I fail to make the connection with 'REST' services. No hard feelings, cheers mate! May 16, 2012 at 20:26
  • 1
    @stefgosselin, I didn't just give a link to a module. I also summarized how the modules work: modifying the validation for the user form via a form_alter, and calling out to the LDAP server from w/in the validate callback. Modify "call out to the LDAP" with "call out to the REST service" and you have a workable starting point.
    – mpdonadio
    May 16, 2012 at 21:01

2 Answers 2


Based off of your comments, it sounds like you have the basic procedure down: hook_form_alter the user_login form, and use your own validation.

If you take a look at user_login_default_validators, I think your problem is that you need to swap out user_login_authenticate_validate with your own, but still get the form back into the same state.

I think your best bet is to do your RESTful authentication in a validator, and then set $form_state['uid'] to a valid user in the system.

My suggestion is to create a single user that you map all of your REST logins to, and use this as $form_state['uid']. This way, you still can use the permission system across your site. To get them logged in, you can just do a user_load with the $uid of your special user.

I am not positive, though, if having all of these users will cause any problems with sessions. I have only done something similar with Drupal 6 and each remote user got their own account in Drupal.

  • Great. That's what I needed. Pointing out that I needed to modify $form_state['uid'] led me to a working code.
    – rexposadas
    May 18, 2012 at 0:04

Yes. Your workflow is totally feasible, I have worked on a site that had a very similar set-up, except for the major difference that a user account was created, though account creation required only with a valid email.

The account that was creaated was still seen as 'anonymous' in the session layer of the application, I had to implement it so anonymous users could have cached pages as all users were seen as 'anonymous' instead of being logged in and drupal by default does not cache anonymous page views. This was a D5 setup, I am assuming D7 is most probably still the same.

But, adding a user account is very low overhead, maybe you just delete the user accounts daily or weekly if you really don't want them piling up.

Happy coding

  • Thanks for the info. Do you happen to know where to put the user creation code? i.e. what hook I should implement? Also, I've modified the question to remove my previous requirement
    – rexposadas
    May 16, 2012 at 23:46
  • @rexposadas My pleasure friend this was an interesting question thanks for posting. May 18, 2012 at 10:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.