Questions tagged [authentication-authorization]
Use it for the user authentication/authorization on Drupal core or third-party modules.
366
questions
0
votes
2
answers
373
views
Generate new bearer token with simple_oauth programmatically?
I have a custom service and in the custom service, I want to generate a new Bearer token for the current user ( it's logged in) with simple_oauth module. in its documentation is has not mentioned how ...
- 1,036
2
votes
1
answer
1k
views
Accessing Drupal REST endpoint using Oauth 2 token
I have successfully installed the Simple OAuth module on my website. I am also able to authenticate to it using Postman. I am getting the access_token and the refresh_token when authenticating. ...
CommunityBot
- 1
1
vote
1
answer
2k
views
Unable to run update.php or update modules from web interface
I would really like to be able to install module updates through the web interface or run update.php when needed without changing settings.php, but something seems to be broken in my setup because it ...
CommunityBot
- 1
0
votes
1
answer
2k
views
How to get user data/authenticate with bearer token - Simple OAuth - Decoupled
I am working on a single page application using NUXT and Drupal 8 as headless CMS. for user authentication token I am using Simple OAuth Drupal 8 module. Everything is working fine. I am getting the ...
CommunityBot
- 1
0
votes
1
answer
405
views
hybridauth redirection to an emailed link after success login
Im using hybridauth to let users login from different social media websites ...
I send emails manually to some users with an link to edit specific nodes (for example http://example.com/node/444/edit?...
CommunityBot
- 1
0
votes
1
answer
637
views
REST API OAuth Authorization and Authentication
I am very much confused about the way OAuth authorization and authentication works in Drupal 8/9.
Let me put my points first, please correct me if I am wrong.
Authorization is when an entity proves a ...
CommunityBot
- 1
0
votes
1
answer
1k
views
How can I set up Protected Pages so users only have to log in once?
I'm using the Protected Pages module to make an area of the website - which is about 13 pages - password protected. The problem is that users have to enter the password to view every page rather than ...
CommunityBot
- 1
0
votes
1
answer
539
views
How do I sign in a user based on custom HTTP headers?
I would like to sign-in a user based on some custom headers in the HTTP request. Let's say I have an administrator account whose username is admin. If I send a request to Drupal with a custom header (...
CommunityBot
- 1
3
votes
1
answer
95
views
Check for active/qualified session in EventSubscriber, destroy session and cookies if not
I have an application that has a custom SSO with a third party service. We are porting Drupal 7 code to Drupal 10 to continue the functionality. Previously we had a hook_init function that did the ...
- 98.1k
1
vote
1
answer
777
views
drupal_http_request redirect is not a fully qualified uri. Throws missing schema error 1002
I am trying to authorise with an Viagogo API using oauth in my custom module (i have my credentials from Viagogo). I can construct the initial URL OK but the redirect response from the API is a ...
CommunityBot
- 1
0
votes
1
answer
901
views
working with LDAP authorization hook
While I have been able to use the LDAP authentication hook
(hook_ldap_authentication_allowuser_results_alter) to perform additional authentication,
I have not been able to use what I thought was the ...
CommunityBot
- 1
0
votes
1
answer
1k
views
Issues trying to understand and debug simplesamlphp error
Simplesamlphp used to work on the site. Something changed and now it does not.
The IDP remote config has been verified, including the cert
The SP cert and pem in the simplesamlphp/config folder have ...
CommunityBot
- 1
0
votes
1
answer
942
views
REST Basic Authentication not working
I configured my rest with services and installed the Basic authentication module.
I used Postman and selected basic authentication gave username and password, I got "Missing required argument ...
CommunityBot
- 1
0
votes
1
answer
425
views
Display thumbnailPhoto from Active Directory - Open atrium and LDAP modelude
I am using Open Atrium for my intranet. I got LDAP module installed, the server is configured, same as User, Authentication, and Authorization.
The communication with my Active Directory is successful,...
CommunityBot
- 1
-1
votes
1
answer
38
views
Access arguments only allow administer and user logged in
I am building a module and used the following code to define a route for a user account.
How do I set the access arguments to only allow administrators and the user himself?
$items['user/%/extra-...
- 97k
0
votes
0
answers
62
views
Clean logout from REST service
Considering that none of the usual suggestions really work...
How do I log out with REST?
Logout using REST
Fix for "'csrf_token' URL query argument is invalid" error during logout
...
- 801
0
votes
0
answers
38
views
TFA Session expired when user login
not sure if anyone faces this issue, when I tried to login with the authentication. It shows TFA session has expired. But the user account was logged in. Screenshot attached, I tried to drupal set ...
- 97k
0
votes
1
answer
2k
views
How to Logout user with Basic auth?
I can log in, perfectly fine, but can't get logout to give me a JSON response. Currently, I can only do POST to
d8.com/user/logout?csrf_token=123&?_format=json
and that would log out, even ...
CommunityBot
- 1
6
votes
1
answer
537
views
Automated login with LDAP always returns error
I have successfully setup LDAP module to authenticate users (and create new users). This is done through manual login form. Now I'm trying to enable automated single sign-on, but with no luck.
I ...
CommunityBot
- 1
0
votes
2
answers
426
views
Can not login with HybridAuth
I installed Drupal HybridAuth module on my site for social authentication. I configured this module and it is displaying fine on site block. But when I try to login with any Social Media account ...
CommunityBot
- 1
0
votes
1
answer
952
views
How do I use the login for an external application?
Long ago I built a php based application for room reservations which basically ran on its own – outside the website's CMS. It was part of what I would now call a custom made intranet – or "custom-app"....
CommunityBot
- 1
1
vote
1
answer
570
views
Problem with OAuth2 refresh token
I have the following problem with the simple_oauth module.
I can get the initial jwt token with a POST request to /oauth/token with the following form data:
username: user
password: password
...
CommunityBot
- 1
0
votes
1
answer
508
views
LDAP module + Windows AD
I have a large AD setup which has not been configured in the ideal fashion, the base DN:
dc=davinci,dc=mydomain,dc=local
Now the existing structure of our AD looks something like:
@ 1122 Logan
...
CommunityBot
- 1
4
votes
1
answer
729
views
Can't login using OpenId (core) and Google profile
I'm using the OpenId module (included in core v7) but can't link an OpenId to an existing account. Every time I try to add it an error occurs:
Sorry, that is not a valid OpenID. Ensure you have ...
CommunityBot
- 1
0
votes
1
answer
92
views
Adding role to a user after login - after simplesamlphp/externalauth
Adding more context to my question
here is the scenario:
a) the organization has different departments
b) actual Drupal roles are not assigned through simplesaml role attribute but through simplesaml ...
- 111
0
votes
0
answers
63
views
403 Forbidden after 10 POSTs
Problem/Motivation
Repeated posting a redhen_contact via the Drupal JSON:API succeeds for exactly 10 times in a row. The 11th attempt fails with 403 status code.
After waiting for 60-120 seconds, the ...
1
vote
1
answer
196
views
Authentication provider for specific REST resource only
I would like to use my own auth provider for my REST services. While there's no fundamental problem with creating it, adding to my services.yml and referencing it in the .yml of the resource, it is ...
- 798
2
votes
2
answers
2k
views
Before login hook
Is there a Drupal 8 hook for pre-login? I would like to redirect the login information of a user on a web server by URL.
I know there is hook_user_login(), but this one only looks called once the ...
- 4,193
-1
votes
1
answer
144
views
"No route found for GET" on custom REST resource when posting
I'm seeing really weird behavior. I've created a custom REST resource at the route /user/login-special.
This is a passwordless login resource, so I pass the mail address and then get a response that ...
- 28k
3
votes
1
answer
598
views
Using OAuth2 on non-REST endpoints
I have a custom module which includes a ControllerBase. The controller has a content() function that returns a JsonResponse(). The code for this function returns a complete list of a certain entity ...
CommunityBot
- 1
1
vote
1
answer
208
views
How can I set view permissions for content type to make it visible to autenticated users only?
I want a content type to be only visible to authenticated users.
Now the edit permission dialog only offers permissions for modification, not for displaying the published content.
Until Drupal 9, I've ...
- 184
6
votes
1
answer
3k
views
Drupal reuses its hash salt
The instructions in default.settings.php say
This variable will be set to a random value by the installer. All one-time
login links will be invalidated if the value is changed. Note that if ...
- 97k
0
votes
1
answer
69
views
simple_oauth refresh token works only one time
I use the [simple_oauth][1] module to authenticate the user.
I have generated the first access_token using the grant_type=password.
then I have tried to get a new access_token using my refresh_token ...
- 5,558
0
votes
1
answer
66
views
401 error when trying to retrieve OAuth authorization code
I'm building a decoupled Next.js frontend to consume data from Drupal JSON:API on a local site installed with Lando. I want to use the simple_oauth module to allow registered users to edit content on ...
- 17.3k
0
votes
1
answer
163
views
401 error when trying to retrieve OAuth access token
I'm trying to configure simple_oauth to use with local Lando install of a Drupal 9 site with decoupled React frontend.
I followed the instructions at https://drupalize.me/tutorial/install-and-...
- 897
0
votes
1
answer
166
views
Errors when providing or generating keys for Simple OAuth module
I'm trying to configure simple_oauth to use with local Lando install of a Drupal 9 site with decoupled React frontend.
I've tried to manually generate the keys in the terminal:
$ openssl genrsa -out ...
- 21
0
votes
1
answer
1k
views
I cannot sign into my drupal site. The login page just refreshes and there are no error messages
I cannot login into any account from the login page. I can get to the admin page by doing drush user-login but if I log out of admin and try logging in again, the login page just refreshes and I do ...
CommunityBot
- 1
0
votes
1
answer
76
views
Is there a way to validate access & refresh tokens issued using the Simple OAuth module?
I am using the OAuth2 authorization code grant with the Simple OAuth module. Everything is working, however I would like to be able to validate access and refresh tokens from my frontend NodeJS server....
- 5,558
17
votes
2
answers
26k
views
Understanding Drupal's session management and user authentication
I have a requirement to replace the default user authentication with the authentication of a central server, i.e., the SSO server.
By debugging Drupal, I learned that all the session management ...
- 10.9k
0
votes
0
answers
68
views
user_login_finalize only works when the user has admin roles
i create custom login form in drupal 9 using user_login_finalize function. But this function only work when user has admin roles... i dont know why. This is my code :..
{
if (isset($_POST['email'])...
- 97k
0
votes
0
answers
37
views
What is the preferred workflow for setting up TFA for users?
I have a D7 site in which I've setup TFA using TOTP. If TFA is not required, the user can login with their user/pwd, visit the profile page, click the security tab, and setup TFA.
However, if TFA is ...
- 97k
1
vote
1
answer
298
views
Cookie authentication when reguistering users through REST API
I am running Drupal 9 commerce 2.0 as headless CMS, and I am trying to integrate the user registration/user login part of my frontend application. I was able to use the user/register REST API to ...
- 708
0
votes
1
answer
342
views
Problem with refreshing the access token
I am building an app which uses Drupal (9.4.8) as the API. I am using the Simple OAuth module to authorise the client. I have got almost everything working fine, I am receiving the Access Token and ...
- 11
0
votes
2
answers
38
views
Oauth/Saml for particular pages
I see several modules that allow oauth2/oicd/saml login to the Drupal website (my id provider allows any of the above). I am looking for different setup, I would like to configure the site so that ...
0
votes
1
answer
353
views
Add "Request new Password" link to user logIn page
I am using the Logintoboggan module to redirect users to the login page when they try to visit a page for which they don't have the permission to visit.
How do I add a Request new Password or Forgot ...
CommunityBot
- 1
0
votes
1
answer
41
views
TFA Module not providing place to enter code, email is sent
I am having trouble getting TFA working on a new site -- Drupal 9.4.
My key's in place, I have email enabled, as well as trusted browser, etc. But when I go to login, after I enter the username and ...
- 309
0
votes
2
answers
91
views
Authentication from a dynamically generated form
I have implemented a feature for PDF conversion using an external java program based on iText (performance is not an issue, the system is for internal usage only, users are less than a hundred, ...
- 17.3k
1
vote
1
answer
1k
views
JSON:API authorization
I'm at the early stages of trying to figure out the Drupal JSON API and can't figure out what's causing the following errors.
Some resources have been omitted because of insufficient authorization.
...
CommunityBot
- 1
2
votes
2
answers
755
views
How to securely authenticate content embeded in another site?
I need to embed password protected content to a second domain with an iframe. The content itself is a view which will be displayed on a third party site via an iframe and the content is prepared with ...
- 97k
-1
votes
1
answer
143
views
Trim or strip spaces around the email or username on the login page [closed]
I know that my Drupal installation (9.3.15) doesn't trim spaces at the login page (form id: user-login-form).
I have some code in the HOOK_form_user_login_form_alter but in that place in $form_state I ...
- 97k