16

I have a requirement where, I have to replace the default user authentication with the authentication of a central server i.e. SSO server.
By debugging Drupal I came to know that all the session management happens in includes/session.inc file. I want to do authentication as shown in the image:

snap

SCENARIO: Login
The details of the steps would be:

  1. Replace the login form to submit the username and password to SSO server (not on Drupal, but on .NET).
  2. Authenticate the user on SSO server using database of that site; and send a response back to some custom PHP page of my website (or a form by a module?).
  3. Using the response, identify the user in the users table, and create a session for that user without checking for the password (as it would mean double authentication). By default, Drupal sets a cookie with name of $insecure_session_name variable, and with value $sid. I want Drupal not to set the cookie here, instead send the values of variables to SSO server.
  4. The SSO server will take the values, create a cookie, and drop it in main domain domain.com (to remind both my website and sso server are on sub domain of main domain, which too in not in Drupal). Then, the drupal site can log in by using that cookie.

I know it is a tough ask, I am just looking for pointers as to how should I start? as they say "you should not hack the core". So, my questions are:

  1. Where should I look for to understand how Drupal authentication and session management works in depth?
  2. Is there a way where I could call the functions in includes/session.inc using hooks (as the comments with functions says "for internal use only/not to be modified")?

NOTE: I'll be using the same method to register the user, so that the record remains in central database of the SSO server. And during that will put in some junk password for the same user in Drupal site's database (as the password will not be checked while login).

  • Do you need true SSO (login to one site and you are logged into all sites), or just authenticating against an outside system? – mpdonadio Aug 6 '12 at 12:56
  • @MPD I want a true SSO, which will require logging in in one site and --> authenticating same user on all sites (might not be on Drupal. – AjitS Aug 17 '12 at 10:12
  • @AjitS if you have successfully implemented this can you please put detailed answer. i am using user_login_finalize but i am being told due to GDPR issues i cant store the details in Drupal. – Jignesh Rawal Oct 26 '18 at 11:31
17

Drupal supports external authentication. There are many alternatives authentication modules for Drupal, such as OpenID (included in core), OAuth Connector, or LDAP. Learn more about how Drupal authentication works; the best would be to look at the OpenID and OAuth modules, and to the core login form submit callback. But, AFAIK, they always start the normal Drupal session after a successful authentication.

For session management, Drupal plugs into PHP session handling and register it own handlers. The Drupal session backend is itself pluggable, you can set the session_inc variable to the path of a file providing alternative implementations of the functions found in includes/session.inc. The memcache module use this to store session in memcached.

For references, the OpenID module handle successful authentication in openid_authentication() which itself ceats and call the user login form submit handler (ie. user_login_submit()). This submit handler itself is simple, it loads the successfully authenticated user with user_load() into the global $user variable, it then call user_login_finalize() which handle session, login timestamp in the user table and invoke hook_user_login() implementations.

Another option is the use the user_external_login_register() function. The function will log an external user in. It also creates a local user if needed. If you need more control on local user creation, you can always use user_save(), user_set_authmaps(), user_login_submit() and user_external_load() from you custom call, using user_external_login_register() as template of what needs to be done.

  • 2
    This is pretty much spot on. The Drupal side of logging in external users is suprisingly easy. The heavy lifting (if any) is actually interfacing with the external system. – mpdonadio Aug 6 '12 at 13:15
  • @MPD Finding the opposite, in my particular case. External system = JSON web service = relatively easy stuff. Drupal behaviour = unpredictably changing from version to version = difficult as hell and no useful diagnostics when things break. – Trejkaz Apr 10 '14 at 9:26
1

user_authenticate() APi might come in handy here.

3.Using the response, identify the user in the users table, and create a session for that user without checking for the password (as it would mean double authentication). By default, Drupal sets a cookie with name of $insecure_session_name variable, and with value $sid. I want Drupal not to set the cookie here, instead send the values of variables to SSO server.

EDIT : Once SSO server returns with true use this API to login the user which will automatically take care of sessions for you. I think its better if you use user_authenticate() instead of creating sessions by yourself. It shouldnt make a problem even its a double authentication as long as valid p-assowrd is provided.

Am not sure of 4. Do you want the cookie to be visible in both domains ? If so then in settings.php initialize $cookie_domain to the domain. Then cookies in subsite will be available in parent site.

  • thank you for your response. I can't use user_authenticate because, the authentication doesn't need to happen on Drupal site. I can generate the session by calling drupal_session_generate() and drupal_session_regenerate() from session.inc file. You got it right about requirement for cookie.. please see the edit. – AjitS Aug 6 '12 at 8:25
  • @indrock Check that link. User_authenticate will allow you to login a user provided username & password are correct. In Step 3 when you verify that username & pass is correct on SSO server then use this API to login the user. But you should have password stored on Drupal. Doing this will make it much easier than hacking core. – GoodSp33d Aug 6 '12 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.