I am trying to implement an SSO system for Drupal system. The detailed description of the scenario can be seen in "Understanding Drupal's session management and user authentication".

I did implement the authentication part, as per the using the suggestions provided (thanks to Pierre Buyle). Now, I have a requirement to add the users to Drupal database which are already present in SSO database.
The IT team of SSO will create a form which will post this values to a URL on the Drupal site.

This URL have to catch the request and create a user in Drupal. I'll be using the method user_save() to achieve this.

My questions are:

  1. How do I create this URL in Drupal? (Thought of using hook_menu and use $items to create the URL, but I don't want it to be accessible to users except admin.
  2. How could I read the data from that URL?

I'm not asking for the complete code. Just pointers to which hooks or methods should I use for the use cases would be enough.

  • Wheres the form ? In drupal site ? Then why dont you use a normal register form ? It saves you coding trouble , since you mentioned they will do data entry manually. – GoodSp33d Aug 23 '12 at 12:29
  • @kantu the form is on SSO server (implemented in ASP). So, the IT team will submit the values to Drupal via a form POST, which I need to use to create the user in Drupal. – AjitS Aug 23 '12 at 12:34
  • The functions you want to look at are in the approved comment you linked. Dont use user_save() look at what openid_authenticate() does or user_external_login_register() does. You can read the Post params via $_POST ... – tenken Aug 23 '12 at 17:00
  • @tenken any specific reason not for directly using user_save()? – AjitS Aug 24 '12 at 8:04
  • If you look at like user_external_login_authenticate() or I think user_authenticate() they eventually call a user_save(). Eventually you will want to call user_save() but there is alot of other little things you will likely want/need todo as well in your authentication script. – tenken Aug 27 '12 at 15:16

IMHO, integration of different system through form POSting is at the hack level. To let external system inject data into Drupal, the Services module let you easily build HTTP REST API in Drupal. It comes out of the box with a user API that allow external system to easily create new Drupal users.

Off course, you can create your own page to receive POSTed data from a form build outside Drupal. You simply have to declare it through a hook_menu() implementation. For access control to the page, you can either use the 'access arguments' to restrict access with Drupal permission system. you can also use your own 'access callback' to implement your own access control logic (ie. for instance, using a secret token based access control).


Used hook_menu() to create an URL, and got the values which were POSTed on this URL (as per @Pierre 's suggestion)

function MYMODULE_menu() {
    $items['add-new-user'] = array (
        'title' => '',
        'type' => 'MENU_CALLBACK',
        'page callback' => 'MYMODULE_add_new_custom_user',
        'page arguments' => array($_POST),
        'access arguments' => array('access administration pages'), //Admin access only
    return $items;

In the function to create user, used user_save() to save the user.

function MYMODULE_add_new_custom_user($post_value) {
    $account = new stdClass();
    $account->is_new = TRUE; //This is a new account
    $edit = array (     
        'roles' => array(
          //left empty because only needed to create authenticated users
        'administer_users' => FALSE,
        'name' => $post_values['username'],
        'mail' => $post_values['mail'],
        'status' => FALSE,   //newly created user would have STATUS as blocked.
        'notify' => 0,
        'timezone' => 'America/Chicago',
        'signature' => '',
        'picture' => '',
        'picture_delete' => '',
        'picture_upload' => '',
        'signature_format' => 'filtered_html',
        'pass' => $post_values['pass'],
        'init' => $post_values['mail'],     

    $user_obj = user_save($account, $edit, 'account');
    if(isset($user_obj->uid)) { //as $user_obj will be an object of stdClass and not an array.
      //user created
    else {
      //some error occurred, handled seperately;
      //user_save returns FALSE if saving a users returns any error. 
  • 1
    I'm surprised 'page arguments' => array($_POST), works. Page arguments in hook_menu are resolved when the menu cahe is rebuild, not when the age is accessed. – Pierre Buyle Nov 14 '16 at 17:54
  • @PierreBuyle Not sure. This was one of my initial tasks when I started working with Drupal, and I remember this to be working! Now I realize what a loophole I ended up creating that time without a CSRF token ;) – AjitS Nov 15 '16 at 5:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.