Questions tagged [authentication-authorization]

Use it for the user authentication/authorization on Drupal core or third-party modules.

Filter by
Sorted by
Tagged with
-2 votes
1 answer
59 views

How to make users stay logged in across devices? [closed]

https://api.drupal.org/api/drupal/core!modules!user!user.module/function/user_login_finalize/9.2.x regenerates the sessions each time the user logs in. This can become a little hassle if user for ...
user avatar
  • 27
0 votes
1 answer
60 views

Wrong user page loaded after user_login_finalize()/user_logout()

I have a third party login custom module that calls user_login_finalize() after authentication, and user_logout() upon logout. Both of these functionalities work except if the user logs in/out from ...
user avatar
  • 253
0 votes
0 answers
14 views

Does the "Simple OAuth (OAuth2) & OpenID Connect" module support integration with 3rd party Authorization servers?

Does Drupal "Simple OAuth (OAuth2) & OpenID Connect" module support authenticating Access Tokens (in JWT format) generated by a 3rd party Authorization server? We are using Client ...
user avatar
  • 11
1 vote
0 answers
16 views

"JSON Web Authentication (JWT)" module support for 3rd party JTW issuer

Does Drupal "JSON Web Authentication (JWT)" module support authenticating JWTs generated by a 3rd party JWT Issuer (rather than by the internal module's Issuer)?
user avatar
  • 11
0 votes
0 answers
40 views

Drupal Webform REST

I am trying to use Drupal Webform REST. I got an error "The 'restful post webform_rest_submit' permission is required." on browser console. I have enabled modules and REST resources as ...
user avatar
  • 1
0 votes
1 answer
75 views

"There have been more than 5 failed login attempts for this account. It is temporarily blocked." and the flood table is empty

When I try to log in as an admin user, I am getting the following error: There have been more than 5 failed login attempts for this account. It is temporarily blocked. Try again later or request a ...
user avatar
0 votes
0 answers
84 views

LDAP integration not working with Drupal 9 (using Ludwig as a composer alternative - was working under Drupal 8)

I 'm having a problem since updating to Drupal 9, with regards to LDAP integration. Previously, while on Drupal 8, I had successfully integrated my schools LDAP for users authentication, using the ...
user avatar
  • 169
2 votes
3 answers
217 views

AccessDeniedHttpException on a route with _access: TRUE

In my custom module I have a few "publication" routes that do not need any kind of authentication. Months ago I learnt that I could achieve this with the following requirements in routing....
user avatar
0 votes
1 answer
37 views

Get client credentials from Simple Oauth module

I am creating user authentification with Drupal 9 + NuxtJS. Using Simple Oauth module and create post requests to oauth/token with data const data = { grant_type: 'password', client_id: '', ...
user avatar
0 votes
0 answers
115 views

How to authenticate users with SAML on a decoupled site

I have a Drupal 9 website that uses SimpleSAMLPHP for SSO with MS ADFS. Now I want to convert this website to decoupled architecture and would like to create some pages in Angular and the rest of the ...
user avatar
0 votes
2 answers
94 views

The sequence of actions upon cookie-authentication to Drupal site

There is a drupal 9 site that has a REST-endpoint that can be accessed for logged-in users (not for anonymous ones). And, it's necessary to make a GET request to the endpoint using cookie ...
user avatar
0 votes
0 answers
14 views

Link user to a LDAP user

I have the LDAP authentication module installed, and have a user that is not able to sign in using LDAP. In the database I can see that there is no DN string for this user. I have got the DN string ...
user avatar
  • 101
0 votes
0 answers
31 views

Getting 403 randomly on files

I have a react-native app that authenticates with Drupal via oAuth2 (simple_oauth, openidconnect) and do not use cookies. I use my access token for all rest calls, images and other files. Very ...
user avatar
0 votes
0 answers
31 views

Unable to log in using Chrome browser

I having an issue with my Drupal site (8.9.19) Using Firefox browser, there is no problem login for all users However, when using Chrome - users are unable to access. This is what I received in the ...
user avatar
2 votes
0 answers
23 views

Drupal access without authentication depending on the source network

Is it possible to avoid the login page depending on the user's network of origin? We have a Drupal setup that can be accessed from a VPN and from the internet. We would like to make it so that users ...
user avatar
2 votes
0 answers
27 views

Should post requests revoke my access token when using Simple Oauth?

I'm using Simple Oauth (4.x) in a headless application which is working well. However, I have noticed that when doing a post request that my access token is revoked, and the next post request will ...
user avatar
  • 507
-1 votes
1 answer
34 views

Using Authentication API module

I'm trying to use the User Authentication API module. My goal is to add some post-processing after successful Drupal 7 login that posts JSON to an external web service. This would be work very similar ...
user avatar
  • 19
0 votes
0 answers
29 views

How can I allow users to change their email addresses without a password with JSON:API?

I have an Ionic React app and I want to allow users to change their email addresses. However, when I try to change the email address in a PATCH request, I get the following error: { "jsonapi&...
user avatar
1 vote
1 answer
82 views

How can I implement sign in with Google / Apple for a decoupled site?

I have a decoupled Drupal site that uses JSON:API to serve an Ionic React app. I'm currently using the JWT (JSON Web Token Authentication module to enable users to register and log in (alongside the ...
user avatar
0 votes
0 answers
30 views

Enabling MFA on some routes when using simpleSAMLphp Authentication?

We're having a Drupal 8/9 setup acting as an SP with simpleSAMLphp Authentication module, against Shibboleth IdP. Now there's a need for including an app on certain pages, and the users using that app ...
user avatar
  • 1
0 votes
1 answer
30 views

Securing admin account, silly "solution" found

Hello fellow Drupalers, I've been given the task of securing our admin account, on our websites (drupal 7) from outsiders. My first thought was 2FA and I looked at some of the modules (tfa, google ...
user avatar
0 votes
1 answer
760 views

How to get current user jwt token?

In a custom module, I need to get the jwt token (access_token) related to the current user. Following this issue I've tried to get it, but without success, because get_jwt_key() and jwt_token_params() ...
user avatar
  • 582
0 votes
1 answer
42 views

How do I let users cancel their account with JWT / JSON:API?

I am making an Ionic app with Drupal as the backend. Users log in via JWT. I'm using JSON:API to send data to Ionic. Now I want to allow users to cancel their accounts in the app (by JSON:API) ...
user avatar
0 votes
1 answer
687 views

Success with cookie, fails with JWT: RuntimeException: Failed to start the session because headers have already been sent

My Controller is working with cookie auth but failing with JWT. This Controller is supposed to flag an entity for the logged-in user. If I am using cookie auth, there are no errors and everything ...
user avatar
0 votes
1 answer
30 views

How do I allow only username for password reset form?

By default the password reset module allows 'Username OR E-mail'. I am using a module which allows multiple user accounts with a same email address (but usernames are unique and auto-generated), so ...
user avatar
0 votes
1 answer
44 views

OAuth2 Server sending 'null' as the 'sub' parameter instead of User Id

When using OAuth2 Server module to authorize with users, I am not receiving the correct "sub" parameter in the response from the server. I get all the other fields such as email, ...
user avatar
1 vote
0 answers
84 views

How to get a JWT token when not logged in

If I am logged in (have a session cookie) and make a GET request to /jwt/token, then I get a JWT token. How do I get the token if I am not logged in? This article by Preston So states: As a logged-...
user avatar
-1 votes
1 answer
107 views

Query user_field_data in Drupal

I need to query the user_field_data table to see if a user exists. Through a query string, I pass to a php script that is on the server username and password in clear text. This script connects to the ...
user avatar
1 vote
1 answer
681 views

Decoupled login: How do I get the session cookie via JavaScript?

In the Medium app, if you go to the settings tab, you can change some of the settings inside the app. But, if you try to change your email notification settings, it opens up a web browser inside the ...
user avatar
4 votes
2 answers
284 views

How to implement stateless authentication

I'm having a big problem with Drupal 8, I want Drupal to trust a downstream reverse proxy that performs authentication against a third party provider, then passes a JWT in a X_ID_TOKEN header. As I ...
user avatar
1 vote
1 answer
186 views

Programmatically log in a user

I am trying to authenticate users as below. I don't get any error, but it doesn't log in users. autoLogin.php is located in the root folder. Visiting http://example.com/drupal8/autoLogin.php shows me ...
user avatar
0 votes
1 answer
309 views

I cannot sign into my drupal site. The login page just refreshes and there are no error messages

I cannot login into any account from the login page. I can get to the admin page by doing drush user-login but if I log out of admin and try logging in again, the login page just refreshes and I do ...
user avatar
0 votes
1 answer
424 views

JSON:API authorization

I'm at the early stages of trying to figure out the Drupal JSON API and can't figure out what's causing the following errors. Some resources have been omitted because of insufficient authorization. ...
user avatar
0 votes
1 answer
622 views

Issues trying to understand and debug simplesamlphp error

Simplesamlphp used to work on the site. Something changed and now it does not. The IDP remote config has been verified, including the cert The SP cert and pem in the simplesamlphp/config folder have ...
user avatar
0 votes
1 answer
262 views

How do I restrict GraphQL access with Basic Auth?

According to this Gitbook (near the bottom), its possible to require GraphQL query authentication with Drupal Core's Basic Auth module. This allows GraphQL to authenticate against a user stored in the ...
user avatar
  • 627
2 votes
1 answer
70 views

Using an authentication provider to keep a user permanently logged in eventually causes session problems

Because I got fed up of having to log in to my local development sites every however long, I tried making a simple custom module that just has an Authentication Provider service that always returns ...
user avatar
  • 797
1 vote
1 answer
59 views

Why doesn't the authentication work?

I am using Rest web service . I CREATED a view called ART and specified its path (/viewpath) and I set the http baisc authentication within that view's structure such that the results will be ...
user avatar
  • 25
0 votes
1 answer
274 views

How do I sign in a user based on custom HTTP headers?

I would like to sign-in a user based on some custom headers in the HTTP request. Let's say I have an administrator account whose username is admin. If I send a request to Drupal with a custom header (...
user avatar
-1 votes
1 answer
173 views

What is correct api key name in headers

I'm using this module https://www.drupal.org/project/services_api_key_auth, it states that you can either put the api_key in query string or inside header. In query it works like this domain.com/api/...
user avatar
0 votes
0 answers
18 views

Authenticated user cannot view custom content type pages

I have a new Drupal 8 website which only two of us have login access to. I'm the administrator and the other person is an authenticated user. I've set the permissions so that authenticated users can ...
user avatar
  • 77
0 votes
1 answer
29 views

Delegate user administration to a limited set of users

We are currently using the excellent domain module (allows segmenting users by domain) in and the user_import module (allows uploading users via CSV) in Drupal 7. We've got a new requirement where we ...
user avatar
0 votes
1 answer
233 views

REST API OAuth Authorization and Authentication

I am very much confused about the way OAuth authorization and authentication works in Drupal 8/9. Let me put my points first, please correct me if I am wrong. Authorization is when an entity proves a ...
user avatar
  • 109
0 votes
1 answer
185 views

Generate new bearer token with simple_oauth programmatically?

I have a custom service and in the custom service, I want to generate a new Bearer token for the current user ( it's logged in) with simple_oauth module. in its documentation is has not mentioned how ...
user avatar
  • 20.6k
0 votes
1 answer
98 views

Are passwords entered in the login form encrypted?

In the user login page, is the value entered for the password encrypted to avoid it can be sniffed by a hacker?
user avatar
  • 554
0 votes
1 answer
929 views

How to get user data/authenticate with bearer token - Simple OAuth - Decoupled

I am working on a single page application using NUXT and Drupal 8 as headless CMS. for user authentication token I am using Simple OAuth Drupal 8 module. Everything is working fine. I am getting the ...
user avatar
0 votes
1 answer
70 views

simplesamlphp_auth installation fails on Centos 8-server

I am trying to install simplesamlphp_auth to Centos 8/Drupal 8 server according the instructions on: https://www.drupal.org/docs/8/modules/apigee-developer-portal-kickstart/integrate-simplesamlphp- ...
user avatar
  • 27
0 votes
1 answer
388 views

How do i verify users passwords from the hash in the database without drupal core logic

I oversee a proprietary CMS with a headless Drupal back-end. We use Drupal to authenticate users, manage permissions and roles, and store HTML for almost 13, 000 pages. As our needs have grown, our ...
user avatar
-1 votes
1 answer
59 views

Locked out of my locally hosted Drupal site [duplicate]

I am running a local distribution of Drupal "commons" using Acquia Dev Desktop on a mac and somehow got locked out of my site. I saved my login info and am almost sure it's correct, but I'm still ...
user avatar
  • 19
1 vote
0 answers
390 views

cant read current user in middleware

i am relatively new to drupal . thus i am trying to make an sso system work . i have this parent domain "domain.com" and the drupal site is running on sub.domain.com  . i can read the cookies and all ....
user avatar
1 vote
1 answer
160 views

What's the quivalent of node_access()?

I need to test if a given user (in my case, the currently logged-in user) has access to a given node for one of the existing operations. In Drupal 7, I could use the following code. if (node_access('...
user avatar

1
2 3 4 5
7