Skip to main content

Questions tagged [authentication-authorization]

Use it for the user authentication/authorization on Drupal core or third-party modules.

Filter by
Sorted by
Tagged with
0 votes
1 answer
2k views

How to get user data/authenticate with bearer token - Simple OAuth - Decoupled

I am working on a single page application using NUXT and Drupal 8 as headless CMS. for user authentication token I am using Simple OAuth Drupal 8 module. Everything is working fine. I am getting the ...
0 votes
1 answer
619 views

How do I sign in a user based on custom HTTP headers?

I would like to sign-in a user based on some custom headers in the HTTP request. Let's say I have an administrator account whose username is admin. If I send a request to Drupal with a custom header (...
0 votes
1 answer
1k views

How can I set up Protected Pages so users only have to log in once?

I'm using the Protected Pages module to make an area of the website - which is about 13 pages - password protected. The problem is that users have to enter the password to view every page rather than ...
0 votes
1 answer
880 views

REST API OAuth Authorization and Authentication

I am very much confused about the way OAuth authorization and authentication works in Drupal 8/9. Let me put my points first, please correct me if I am wrong. Authorization is when an entity proves a ...
0 votes
1 answer
19 views

How to restrict access to GET with JSON:API for specific entity type?

According to the JSON:API docs, you can implement the alterRoutes() method on a route subscriber to restrict access to collections. In a custom module, I have an entity type that should be POST only (...
1 vote
1 answer
787 views

drupal_http_request redirect is not a fully qualified uri. Throws missing schema error 1002

I am trying to authorise with an Viagogo API using oauth in my custom module (i have my credentials from Viagogo). I can construct the initial URL OK but the redirect response from the API is a ...
0 votes
0 answers
11 views

Limit Per User Tokens in Drupal Simple OAuth

I'm looking for a way to limit the maximum number of tokens granted to each user in Drupal 10, similar to how we can limit the number of sessions per user using the Drupal Session Limit module. Is ...
0 votes
1 answer
930 views

working with LDAP authorization hook

While I have been able to use the LDAP authentication hook (hook_ldap_authentication_allowuser_results_alter) to perform additional authentication, I have not been able to use what I thought was the ...
0 votes
1 answer
1k views

REST Basic Authentication not working

I configured my rest with services and installed the Basic authentication module. I used Postman and selected basic authentication gave username and password, I got "Missing required argument ...
0 votes
1 answer
1k views

Issues trying to understand and debug simplesamlphp error

Simplesamlphp used to work on the site. Something changed and now it does not. The IDP remote config has been verified, including the cert The SP cert and pem in the simplesamlphp/config folder have ...
0 votes
0 answers
60 views

Why doesn't currentUser return correct permissions?

This happens a lot of the time in my custom Drupal 10 module and I cannot figure out why. Custom permissions return wrong value with currentUser but returns correct value when loading user by uid. $...
0 votes
1 answer
41 views

Read-only Permissions page

Is there a way to set the permissions page read-only? I want to prevent certain roles from making any changes to the permissions but still able to view the permissions page. Alternatively, if that is ...
1 vote
1 answer
767 views

Separate permissions for form access and form submit

I have a module on a website, called members, and 2 roles: "low admin" and "manager". They have permissions: 'low admin tasks' and 'manager tasks'. Every low admin has access to both permissions. ...
0 votes
1 answer
22 views

How to prevent the anonymous user from being the author of a custom entity type?

I am making a module that stores push notification tokens as a custom entity type. Because of the nature of push notification tokens (sending a notification to the user's device, like an email address)...
6 votes
1 answer
565 views

Automated login with LDAP always returns error

I have successfully setup LDAP module to authenticate users (and create new users). This is done through manual login form. Now I'm trying to enable automated single sign-on, but with no luck. I ...
2 votes
2 answers
767 views

How can I set view permissions for content type to make it visible to autenticated users only?

I want a content type to be only visible to authenticated users. Now the edit permission dialog only offers permissions for modification, not for displaying the published content. Until Drupal 9, I've ...
0 votes
2 answers
431 views

Can not login with HybridAuth

I installed Drupal HybridAuth module on my site for social authentication. I configured this module and it is displaying fine on site block. But when I try to login with any Social Media account ...
0 votes
1 answer
2k views

How to Logout user with Basic auth?

I can log in, perfectly fine, but can't get logout to give me a JSON response. Currently, I can only do POST to d8.com/user/logout?csrf_token=123&?_format=json and that would log out, even ...
0 votes
1 answer
511 views

LDAP module + Windows AD

I have a large AD setup which has not been configured in the ideal fashion, the base DN: dc=davinci,dc=mydomain,dc=local Now the existing structure of our AD looks something like: @ 1122 Logan ...
4 votes
1 answer
730 views

Can't login using OpenId (core) and Google profile

I'm using the OpenId module (included in core v7) but can't link an OpenId to an existing account. Every time I try to add it an error occurs: Sorry, that is not a valid OpenID. Ensure you have ...
1 vote
1 answer
621 views

Problem with OAuth2 refresh token

I have the following problem with the simple_oauth module. I can get the initial jwt token with a POST request to /oauth/token with the following form data: username: user password: password ...
0 votes
1 answer
985 views

How do I use the login for an external application?

Long ago I built a php based application for room reservations which basically ran on its own – outside the website's CMS. It was part of what I would now call a custom made intranet – or "custom-app"....
2 votes
1 answer
3k views

How can I redirect using hook_init()?

When the requested page is /user/login, users should be redirected to /mylogin. I know this is possible with hook_init() or hook_boot(). Can someone explain how this can be achieved, exactly?
0 votes
1 answer
229 views

How can I redirect a user upon login?

When users log in from the front page, they should be redirected to the dashboard; when they log in from other pages, they should be redirected to the same page they were. I think that the Login ...
0 votes
1 answer
769 views

Validation message on Login form not shown [closed]

On /user/login, when I forget to enter the login credentials, and click on the submission button, no error message is shown as expected. What problem might be causing this?
1 vote
0 answers
35 views

Calculate config entity dependencies

I am the maintainer of the Authorization project. It provides a config entity type, the authorization profile. The profile requires two plugin types: provider and consumer. Other modules supply the ...
0 votes
1 answer
405 views

hybridauth redirection to an emailed link after success login

Im using hybridauth to let users login from different social media websites ... I send emails manually to some users with an link to edit specific nodes (for example http://example.com/node/444/edit?...
1 vote
1 answer
136 views

How to allow users to log in by multiple email addresses?

I'm trying to find a way to allow users to log in by email address when they have multiple email addresses registered on my site. I'm using the Email Registration module to allow users to register ...
2 votes
1 answer
2k views

Accessing Drupal REST endpoint using Oauth 2 token

I have successfully installed the Simple OAuth module on my website. I am also able to authenticate to it using Postman. I am getting the access_token and the refresh_token when authenticating. ...
1 vote
1 answer
2k views

Unable to run update.php or update modules from web interface

I would really like to be able to install module updates through the web interface or run update.php when needed without changing settings.php, but something seems to be broken in my setup because it ...
0 votes
1 answer
187 views

RestUI: The used authentication method is not allowed on this route

The following works on three sites but doesn't work on one. I've restored the site from the backup of another site, and this works, until it doesn't work the next day. I've reinstalled modules. I make ...
1 vote
2 answers
194 views

How can I allow users to change their email addresses without a password via REST/JSON:API?

To change the password of a user account, Drupal requires the user to input their password. I have a decoupled Drupal app using JSON:API. The Nocurrent Pass module disables the password check when ...
2 votes
1 answer
153 views

All users can't login

After migrating from Drupal 9 to Drupal 10 all users can't login. I tried: Removing settings.php and adding a new version Emptying the sessions table in the database Clearing cache, updating database ...
0 votes
1 answer
436 views

Display thumbnailPhoto from Active Directory - Open atrium and LDAP modelude

I am using Open Atrium for my intranet. I got LDAP module installed, the server is configured, same as User, Authentication, and Authorization. The communication with my Active Directory is successful,...
1 vote
1 answer
81 views

The username used for a failed login attempt is not reported anymore

Just completed a migration of a site from Drupal 7 to 10, and it's gone pretty smoothly after quite a bit of preparation. One thing seems different in a frustrating way: In the prior site on Drupal7, ...
0 votes
1 answer
127 views

Login via POST method returns a 403 error

I have enabled the Rest and the Basic Auth core modules on a Drupal 10 site, but I am unable to log in using the following code. I keep getting a 403 error. $drupalUsername = 'myuser'; $drupalPassword ...
0 votes
1 answer
61 views

Impossible to change admin password, script gives me different hash every time (???)

Context: Drupal 9.14 installed on a small EC2 server for testing After a composer update, my admin password stopped working (first strange event). I decided to use the password-hash.sh to recreate one ...
0 votes
0 answers
96 views

How can I switch from Redis flood control back to Drupal's default flood control?

Related question: Why can't I log in when there is no flood table? I have a Drupal 10 site hosted on PlatformSH that has Redis enabled. I have the Redis module enabled. On a test domain, my test ...
1 vote
2 answers
542 views

Generate new bearer token with simple_oauth programmatically?

I have a custom service and in the custom service, I want to generate a new Bearer token for the current user ( it's logged in) with simple_oauth module. in its documentation is has not mentioned how ...
3 votes
1 answer
149 views

Check for active/qualified session in EventSubscriber, destroy session and cookies if not

I have an application that has a custom SSO with a third party service. We are porting Drupal 7 code to Drupal 10 to continue the functionality. Previously we had a hook_init function that did the ...
-1 votes
1 answer
42 views

Access arguments only allow administer and user logged in

I am building a module and used the following code to define a route for a user account. How do I set the access arguments to only allow administrators and the user himself? $items['user/%/extra-...
1 vote
0 answers
82 views

Clean logout from REST service

Considering that none of the usual suggestions really work... How do I log out with REST? Logout using REST Fix for "'csrf_token' URL query argument is invalid" error during logout ...
0 votes
0 answers
54 views

TFA Session expired when user login

not sure if anyone faces this issue, when I tried to login with the authentication. It shows TFA session has expired. But the user account was logged in. Screenshot attached, I tried to drupal set ...
0 votes
1 answer
228 views

Adding role to a user after login - after simplesamlphp/externalauth

Adding more context to my question here is the scenario: a) the organization has different departments b) actual Drupal roles are not assigned through simplesaml role attribute but through simplesaml ...
0 votes
0 answers
104 views

403 Forbidden after 10 POSTs

Problem/Motivation Repeated posting a redhen_contact via the Drupal JSON:API succeeds for exactly 10 times in a row. The 11th attempt fails with 403 status code. After waiting for 60-120 seconds, the ...
1 vote
1 answer
310 views

Authentication provider for specific REST resource only

I would like to use my own auth provider for my REST services. While there's no fundamental problem with creating it, adding to my services.yml and referencing it in the .yml of the resource, it is ...
2 votes
2 answers
2k views

Before login hook

Is there a Drupal 8 hook for pre-login? I would like to redirect the login information of a user on a web server by URL. I know there is hook_user_login(), but this one only looks called once the ...
-1 votes
1 answer
290 views

"No route found for GET" on custom REST resource when posting

I'm seeing really weird behavior. I've created a custom REST resource at the route /user/login-special. This is a passwordless login resource, so I pass the mail address and then get a response that ...
3 votes
1 answer
701 views

Using OAuth2 on non-REST endpoints

I have a custom module which includes a ControllerBase. The controller has a content() function that returns a JsonResponse(). The code for this function returns a complete list of a certain entity ...
6 votes
1 answer
3k views

Drupal reuses its hash salt

The instructions in default.settings.php say This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if ...

1
2 3 4 5
8