I have a requirement where, I have to replace the default user authentication with the authentication of a central server i.e. SSO server.
By debugging Drupal I came to know that all the session management happens in
includes/session.inc file. I want to do authentication as shown in the image:
The details of the steps would be:
- Replace the login form to submit the username and password to SSO server (not on Drupal, but on .NET).
- Authenticate the user on SSO server using database of that site; and send a response back to some custom PHP page of my website (or a form by a module?).
- Using the response, identify the user in the users table, and create a session for that user without checking for the password (as it would mean double authentication). By default, Drupal sets a cookie with name of
$insecure_session_namevariable, and with value
$sid. I want Drupal not to set the cookie here, instead send the values of variables to SSO server.
- The SSO server will take the values, create a cookie, and drop it in main domain
domain.com(to remind both
sso serverare on sub domain of main domain, which too in not in Drupal). Then, the drupal site can log in by using that cookie.
I know it is a tough ask, I am just looking for pointers as to how should I start? as they say "you should not hack the core". So, my questions are:
- Where should I look for to understand how Drupal authentication and session management works in depth?
- Is there a way where I could call the functions in
includes/session.incusing hooks (as the comments with functions says "for internal use only/not to be modified")?
NOTE: I'll be using the same method to register the user, so that the record remains in central database of the SSO server. And during that will put in some junk password for the same user in Drupal site's database (as the password will not be checked while login).