I am trying to implement an SSO system for Drupal system. The detailed description of the scenario can be seen in "Understanding Drupal's session management and user authentication".

I did implement the authentication part, as per the using the suggestions provided (thanks to Pierre Buyle). Now, I have a requirement to add the users to Drupal database which are already present in SSO database.
The IT team of SSO will create a form which will post this values to a URL on the Drupal site.

This URL have to catch the request and create a user in Drupal. I'll be using the method user_save() to achieve this.

My questions are:

  1. How do I create this URL in Drupal? (Thought of using hook_menu and use $items to create the URL, but I don't want it to be accessible to users except admin.
  2. How could I read the data from that URL?

I'm not asking for the complete code. Just pointers to which hooks or methods should I use for the use cases would be enough.

  • Wheres the form ? In drupal site ? Then why dont you use a normal register form ? It saves you coding trouble , since you mentioned they will do data entry manually.
    – GoodSp33d
    Aug 23, 2012 at 12:29
  • @kantu the form is on SSO server (implemented in ASP). So, the IT team will submit the values to Drupal via a form POST, which I need to use to create the user in Drupal.
    – AjitS
    Aug 23, 2012 at 12:34
  • The functions you want to look at are in the approved comment you linked. Dont use user_save() look at what openid_authenticate() does or user_external_login_register() does. You can read the Post params via $_POST ...
    – tenken
    Aug 23, 2012 at 17:00
  • @tenken any specific reason not for directly using user_save()?
    – AjitS
    Aug 24, 2012 at 8:04
  • If you look at like user_external_login_authenticate() or I think user_authenticate() they eventually call a user_save(). Eventually you will want to call user_save() but there is alot of other little things you will likely want/need todo as well in your authentication script.
    – tenken
    Aug 27, 2012 at 15:16

2 Answers 2


IMHO, integration of different system through form POSting is at the hack level. To let external system inject data into Drupal, the Services module let you easily build HTTP REST API in Drupal. It comes out of the box with a user API that allow external system to easily create new Drupal users.

Off course, you can create your own page to receive POSTed data from a form build outside Drupal. You simply have to declare it through a hook_menu() implementation. For access control to the page, you can either use the 'access arguments' to restrict access with Drupal permission system. you can also use your own 'access callback' to implement your own access control logic (ie. for instance, using a secret token based access control).


Used hook_menu() to create an URL, and got the values which were POSTed on this URL (as per @Pierre 's suggestion)

function MYMODULE_menu() {
    $items['add-new-user'] = array (
        'title' => '',
        'type' => 'MENU_CALLBACK',
        'page callback' => 'MYMODULE_add_new_custom_user',
        'page arguments' => array($_POST),
        'access arguments' => array('access administration pages'), //Admin access only
    return $items;

In the function to create user, used user_save() to save the user.

function MYMODULE_add_new_custom_user($post_value) {
    $account = new stdClass();
    $account->is_new = TRUE; //This is a new account
    $edit = array (     
        'roles' => array(
          //left empty because only needed to create authenticated users
        'administer_users' => FALSE,
        'name' => $post_values['username'],
        'mail' => $post_values['mail'],
        'status' => FALSE,   //newly created user would have STATUS as blocked.
        'notify' => 0,
        'timezone' => 'America/Chicago',
        'signature' => '',
        'picture' => '',
        'picture_delete' => '',
        'picture_upload' => '',
        'signature_format' => 'filtered_html',
        'pass' => $post_values['pass'],
        'init' => $post_values['mail'],     

    $user_obj = user_save($account, $edit, 'account');
    if(isset($user_obj->uid)) { //as $user_obj will be an object of stdClass and not an array.
      //user created
    else {
      //some error occurred, handled seperately;
      //user_save returns FALSE if saving a users returns any error. 
  • 1
    I'm surprised 'page arguments' => array($_POST), works. Page arguments in hook_menu are resolved when the menu cahe is rebuild, not when the age is accessed. Nov 14, 2016 at 17:54
  • @PierreBuyle Not sure. This was one of my initial tasks when I started working with Drupal, and I remember this to be working! Now I realize what a loophole I ended up creating that time without a CSRF token ;)
    – AjitS
    Nov 15, 2016 at 5:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.