Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [authentication-authorization]

Use it for the user authentication/authorization on Drupal core or third-party modules.

Filter by
Sorted by
Tagged with
0 votes
1 answer
15 views

How to prevent the anonymous user from being the author of a custom entity type?

I am making a module that stores push notification tokens as a custom entity type. Because of the nature of push notification tokens (sending a notification to the user's device, like an email address)...
Patrick Kenny's user avatar
1 vote
0 answers
31 views

Calculate config entity dependencies

I am the maintainer of the Authorization project. It provides a config entity type, the authorization profile. The profile requires two plugin types: provider and consumer. Other modules supply the ...
Binary Alchemist's user avatar
0 votes
1 answer
73 views

RestUI: The used authentication method is not allowed on this route

The following works on three sites but doesn't work on one. I've restored the site from the backup of another site, and this works, until it doesn't work the next day. I've reinstalled modules. I make ...
Victor Pudeyev's user avatar
2 votes
1 answer
99 views

All users can't login

After migrating from Drupal 9 to Drupal 10 all users can't login. I tried: Removing settings.php and adding a new version Emptying the sessions table in the database Clearing cache, updating database ...
Joost's user avatar
  • 1,348
1 vote
1 answer
56 views

The username used for a failed login attempt is not reported anymore

Just completed a migration of a site from Drupal 7 to 10, and it's gone pretty smoothly after quite a bit of preparation. One thing seems different in a frustrating way: In the prior site on Drupal7, ...
AlexT's user avatar
  • 13
0 votes
1 answer
79 views

Login via POST method returns a 403 error

I have enabled the Rest and the Basic Auth core modules on a Drupal 10 site, but I am unable to log in using the following code. I keep getting a 403 error. $drupalUsername = 'myuser'; $drupalPassword ...
giorgio79's user avatar
  • 4,631
1 vote
1 answer
123 views

How to allow users to log in by multiple email addresses?

I'm trying to find a way to allow users to log in by email address when they have multiple email addresses registered on my site. I'm using the Email Registration module to allow users to register ...
Patrick Kenny's user avatar
0 votes
0 answers
79 views

How can I switch from Redis flood control back to Drupal's default flood control?

Related question: Why can't I log in when there is no flood table? I have a Drupal 10 site hosted on PlatformSH that has Redis enabled. I have the Redis module enabled. On a test domain, my test ...
Patrick Kenny's user avatar
0 votes
1 answer
50 views

Impossible to change admin password, script gives me different hash every time (???)

Context: Drupal 9.14 installed on a small EC2 server for testing After a composer update, my admin password stopped working (first strange event). I decided to use the password-hash.sh to recreate one ...
ZozoIT's user avatar
  • 1
3 votes
1 answer
124 views

Check for active/qualified session in EventSubscriber, destroy session and cookies if not

I have an application that has a custom SSO with a third party service. We are porting Drupal 7 code to Drupal 10 to continue the functionality. Previously we had a hook_init function that did the ...
Kevin's user avatar
  • 27.9k
-1 votes
1 answer
40 views

Access arguments only allow administer and user logged in

I am building a module and used the following code to define a route for a user account. How do I set the access arguments to only allow administrators and the user himself? $items['user/%/extra-...
DevNooby's user avatar
0 votes
0 answers
75 views

Clean logout from REST service

Considering that none of the usual suggestions really work... How do I log out with REST? Logout using REST Fix for "'csrf_token' URL query argument is invalid" error during logout ...
Gábor's user avatar
  • 811
0 votes
0 answers
51 views

TFA Session expired when user login

not sure if anyone faces this issue, when I tried to login with the authentication. It shows TFA session has expired. But the user account was logged in. Screenshot attached, I tried to drupal set ...
DevNooby's user avatar
0 votes
1 answer
192 views

Adding role to a user after login - after simplesamlphp/externalauth

Adding more context to my question here is the scenario: a) the organization has different departments b) actual Drupal roles are not assigned through simplesaml role attribute but through simplesaml ...
user3891775's user avatar
0 votes
0 answers
97 views

403 Forbidden after 10 POSTs

Problem/Motivation Repeated posting a redhen_contact via the Drupal JSON:API succeeds for exactly 10 times in a row. The 11th attempt fails with 403 status code. After waiting for 60-120 seconds, the ...
jreinholdt's user avatar
-1 votes
1 answer
253 views

"No route found for GET" on custom REST resource when posting

I'm seeing really weird behavior. I've created a custom REST resource at the route /user/login-special. This is a passwordless login resource, so I pass the mail address and then get a response that ...
Patrick Kenny's user avatar
2 votes
2 answers
610 views

How can I set view permissions for content type to make it visible to autenticated users only?

I want a content type to be only visible to authenticated users. Now the edit permission dialog only offers permissions for modification, not for displaying the published content. Until Drupal 9, I've ...
david's user avatar
  • 196
0 votes
1 answer
125 views

401 error when trying to retrieve OAuth authorization code

I'm building a decoupled Next.js frontend to consume data from Drupal JSON:API on a local site installed with Lando. I want to use the simple_oauth module to allow registered users to edit content on ...
raresample's user avatar
0 votes
1 answer
154 views

simple_oauth refresh token works only one time

I use the [simple_oauth][1] module to authenticate the user. I have generated the first access_token using the grant_type=password. then I have tried to get a new access_token using my refresh_token ...
Marwen Amri's user avatar
0 votes
1 answer
239 views

401 error when trying to retrieve OAuth access token

I'm trying to configure simple_oauth to use with local Lando install of a Drupal 9 site with decoupled React frontend. I followed the instructions at https://drupalize.me/tutorial/install-and-...
raresample's user avatar
0 votes
1 answer
308 views

Errors when providing or generating keys for Simple OAuth module

I'm trying to configure simple_oauth to use with local Lando install of a Drupal 9 site with decoupled React frontend. I've tried to manually generate the keys in the terminal: $ openssl genrsa -out ...
raresample's user avatar
0 votes
1 answer
120 views

Is there a way to validate access & refresh tokens issued using the Simple OAuth module?

I am using the OAuth2 authorization code grant with the Simple OAuth module. Everything is working, however I would like to be able to validate access and refresh tokens from my frontend NodeJS server....
levente.nas's user avatar
0 votes
0 answers
73 views

user_login_finalize only works when the user has admin roles

i create custom login form in drupal 9 using user_login_finalize function. But this function only work when user has admin roles... i dont know why. This is my code :.. { if (isset($_POST['email'])...
Aldi Alhafidzi's user avatar
0 votes
0 answers
39 views

What is the preferred workflow for setting up TFA for users?

I have a D7 site in which I've setup TFA using TOTP. If TFA is not required, the user can login with their user/pwd, visit the profile page, click the security tab, and setup TFA. However, if TFA is ...
lcdservices's user avatar
1 vote
1 answer
399 views

Cookie authentication when reguistering users through REST API

I am running Drupal 9 commerce 2.0 as headless CMS, and I am trying to integrate the user registration/user login part of my frontend application. I was able to use the user/register REST API to ...
levente.nas's user avatar
0 votes
1 answer
458 views

Problem with refreshing the access token

I am building an app which uses Drupal (9.4.8) as the API. I am using the Simple OAuth module to authorise the client. I have got almost everything working fine, I am receiving the Access Token and ...
dfd's user avatar
  • 21
0 votes
2 answers
46 views

Oauth/Saml for particular pages

I see several modules that allow oauth2/oicd/saml login to the Drupal website (my id provider allows any of the above). I am looking for different setup, I would like to configure the site so that ...
Kevin Finkenbinder's user avatar
0 votes
1 answer
60 views

TFA Module not providing place to enter code, email is sent

I am having trouble getting TFA working on a new site -- Drupal 9.4. My key's in place, I have email enabled, as well as trusted browser, etc. But when I go to login, after I enter the username and ...
Adrained's user avatar
  • 319
1 vote
1 answer
271 views

Authentication provider for specific REST resource only

I would like to use my own auth provider for my REST services. While there's no fundamental problem with creating it, adding to my services.yml and referencing it in the .yml of the resource, it is ...
Gábor's user avatar
  • 811
0 votes
2 answers
94 views

Authentication from a dynamically generated form

I have implemented a feature for PDF conversion using an external java program based on iText (performance is not an issue, the system is for internal usage only, users are less than a hundred, ...
Francesco Marchetti-Stasi's user avatar
-1 votes
1 answer
190 views

Trim or strip spaces around the email or username on the login page [closed]

I know that my Drupal installation (9.3.15) doesn't trim spaces at the login page (form id: user-login-form). I have some code in the HOOK_form_user_login_form_alter but in that place in $form_state I ...
mevsme's user avatar
  • 1
0 votes
0 answers
126 views

Best way to allow local users login while using OpenID Connect?

I'm trying to find the best way to allow local users login on a D9 installation that is setup to log the majority of users via OpenID Connect on a keycloak server which I don't handle myself. I may ...
meh's user avatar
  • 3
0 votes
0 answers
158 views

Password reset links sometimes don't work

I've got this problem where once in a while, when a user uses the one time password link, instead of going to the password reset page, it takes them to the home page. Whenever this happens, in the ...
zip_000's user avatar
  • 11
1 vote
0 answers
46 views

How assign new simple_oauth scopes?

I've a problem with simple_oauth module and scopes, on a D 9.3.x site. I'm using it to authenticate user in a decoupled front-end in Next.js. The case is: A (new) user log-in without roles expect ...
Giuseppe's user avatar
  • 971
-3 votes
1 answer
134 views

How to make users stay logged in across devices? [closed]

https://api.drupal.org/api/drupal/core!modules!user!user.module/function/user_login_finalize/9.2.x regenerates the sessions each time the user logs in. This can become a little hassle if user for ...
PartyRadio's user avatar
0 votes
1 answer
228 views

Wrong user page loaded after user_login_finalize()/user_logout()

I have a third party login custom module that calls user_login_finalize() after authentication, and user_logout() upon logout. Both of these functionalities work except if the user logs in/out from ...
Anton's user avatar
  • 283
1 vote
0 answers
70 views

"JSON Web Authentication (JWT)" module support for 3rd party JTW issuer

Does Drupal "JSON Web Authentication (JWT)" module support authenticating JWTs generated by a 3rd party JWT Issuer (rather than by the internal module's Issuer)?
Eric's user avatar
  • 11
0 votes
0 answers
435 views

Drupal Webform REST

I am trying to use Drupal Webform REST. I got an error "The 'restful post webform_rest_submit' permission is required." on browser console. I have enabled modules and REST resources as ...
Rdb's user avatar
  • 11
1 vote
1 answer
693 views

"There have been more than 5 failed login attempts for this account. It is temporarily blocked." and the flood table is empty

When I try to log in as an admin user, I am getting the following error: There have been more than 5 failed login attempts for this account. It is temporarily blocked. Try again later or request a ...
Patrick Kenny's user avatar
0 votes
0 answers
521 views

LDAP integration not working with Drupal 9 (using Ludwig as a composer alternative - was working under Drupal 8)

I 'm having a problem since updating to Drupal 9, with regards to LDAP integration. Previously, while on Drupal 8, I had successfully integrated my schools LDAP for users authentication, using the ...
thomas's user avatar
  • 279
3 votes
3 answers
2k views

AccessDeniedHttpException on a route with _access: TRUE

In my custom module I have a few "publication" routes that do not need any kind of authentication. Months ago I learnt that I could achieve this with the following requirements in routing....
Francesco Marchetti-Stasi's user avatar
0 votes
1 answer
253 views

Get client credentials from Simple Oauth module

I am creating user authentification with Drupal 9 + NuxtJS. Using Simple Oauth module and create post requests to oauth/token with data const data = { grant_type: 'password', client_id: '', ...
Вадим Гаджимурадов's user avatar
0 votes
2 answers
341 views

The sequence of actions upon cookie-authentication to Drupal site

There is a drupal 9 site that has a REST-endpoint that can be accessed for logged-in users (not for anonymous ones). And, it's necessary to make a GET request to the endpoint using cookie ...
Yakimkin Roman's user avatar
0 votes
0 answers
97 views

Getting 403 randomly on files

I have a react-native app that authenticates with Drupal via oAuth2 (simple_oauth, openidconnect) and do not use cookies. I use my access token for all rest calls, images and other files. Very ...
Abdul Sadik Yalcin's user avatar
0 votes
0 answers
98 views

Unable to log in using Chrome browser

I having an issue with my Drupal site (8.9.19) Using Firefox browser, there is no problem login for all users However, when using Chrome - users are unable to access. This is what I received in the ...
Wai Kong Chong's user avatar
2 votes
0 answers
54 views

Drupal access without authentication depending on the source network

Is it possible to avoid the login page depending on the user's network of origin? We have a Drupal setup that can be accessed from a VPN and from the internet. We would like to make it so that users ...
Conrado Pueyo's user avatar
2 votes
0 answers
161 views

Should post requests revoke my access token when using Simple Oauth?

I'm using Simple Oauth (4.x) in a headless application which is working well. However, I have noticed that when doing a post request that my access token is revoked, and the next post request will ...
Chris's user avatar
  • 516
-1 votes
1 answer
93 views

Using Authentication API module

I'm trying to use the User Authentication API module. My goal is to add some post-processing after successful Drupal 7 login that posts JSON to an external web service. This would be work very similar ...
Seth M's user avatar
  • 31
1 vote
2 answers
180 views

How can I allow users to change their email addresses without a password via REST/JSON:API?

To change the password of a user account, Drupal requires the user to input their password. I have a decoupled Drupal app using JSON:API. The Nocurrent Pass module disables the password check when ...
Patrick Kenny's user avatar
1 vote
1 answer
527 views

How can I implement sign in with Google / Apple for a decoupled site?

I have a decoupled Drupal site that uses JSON:API to serve an Ionic React app. I'm currently using the JWT (JSON Web Token Authentication module to enable users to register and log in (alongside the ...
Patrick Kenny's user avatar

1
2 3 4 5
8