Questions tagged [authentication-authorization]
Use it for the user authentication/authorization on Drupal core or third-party modules.
361
questions
0
votes
1
answer
6
views
401 error when trying to retrieve OAuth authorization code
I'm building a decoupled Next.js frontend to consume data from Drupal JSON:API on a local site installed with Lando. I want to use the simple_oauth module to allow registered users to edit content on ...
- 21
0
votes
1
answer
17
views
simple_oauth refresh token works only one time
I use the [simple_oauth][1] module to authenticate the user.
I have generated the first access_token using the grant_type=password.
then I have tried to get a new access_token using my refresh_token ...
- 730
0
votes
1
answer
25
views
401 error when trying to retrieve OAuth access token
I'm trying to configure simple_oauth to use with local Lando install of a Drupal 9 site with decoupled React frontend.
I followed the instructions at https://drupalize.me/tutorial/install-and-...
- 21
0
votes
1
answer
19
views
Errors when providing or generating keys for Simple OAuth module
I'm trying to configure simple_oauth to use with local Lando install of a Drupal 9 site with decoupled React frontend.
I've tried to manually generate the keys in the terminal:
$ openssl genrsa -out ...
- 21
0
votes
1
answer
38
views
Is there a way to validate access & refresh tokens issued using the Simple OAuth module?
I am using the OAuth2 authorization code grant with the Simple OAuth module. Everything is working, however I would like to be able to validate access and refresh tokens from my frontend NodeJS server....
- 41
0
votes
0
answers
28
views
user_login_finalize only works when the user has admin roles
i create custom login form in drupal 9 using user_login_finalize function. But this function only work when user has admin roles... i dont know why. This is my code :..
{
if (isset($_POST['email'])...
0
votes
0
answers
27
views
What is the preferred workflow for setting up TFA for users?
I have a D7 site in which I've setup TFA using TOTP. If TFA is not required, the user can login with their user/pwd, visit the profile page, click the security tab, and setup TFA.
However, if TFA is ...
- 79
1
vote
1
answer
119
views
Cookie authentication when reguistering users through REST API
I am running Drupal 9 commerce 2.0 as headless CMS, and I am trying to integrate the user registration/user login part of my frontend application. I was able to use the user/register REST API to ...
- 41
0
votes
1
answer
155
views
Problem with refreshing the access token
I am building an app which uses Drupal (9.4.8) as the API. I am using the Simple OAuth module to authorise the client. I have got almost everything working fine, I am receiving the Access Token and ...
- 11
0
votes
2
answers
28
views
Oauth/Saml for particular pages
I see several modules that allow oauth2/oicd/saml login to the Drupal website (my id provider allows any of the above). I am looking for different setup, I would like to configure the site so that ...
0
votes
1
answer
27
views
TFA Module not providing place to enter code, email is sent
I am having trouble getting TFA working on a new site -- Drupal 9.4.
My key's in place, I have email enabled, as well as trusted browser, etc. But when I go to login, after I enter the username and ...
- 309
1
vote
0
answers
103
views
Authentication provider for specific REST resource only
I would like to use my own auth provider for my REST services. While there's no fundamental problem with creating it, adding to my services.yml and referencing it in the .yml of the resource, it is ...
- 702
0
votes
2
answers
90
views
Authentication from a dynamically generated form
I have implemented a feature for PDF conversion using an external java program based on iText (performance is not an issue, the system is for internal usage only, users are less than a hundred, ...
0
votes
1
answer
91
views
Trim or strip spaces around the email or username on the login page [closed]
I know that my Drupal installation (9.3.15) doesn't trim spaces at the login page (form id: user-login-form).
I have some code in the HOOK_form_user_login_form_alter but in that place in $form_state I ...
- 297
0
votes
0
answers
33
views
Best way to allow local users login while using OpenID Connect?
I'm trying to find the best way to allow local users login on a D9 installation that is setup to log the majority of users via OpenID Connect on a keycloak server which I don't handle myself.
I may ...
- 3
0
votes
0
answers
96
views
Password reset links sometimes don't work
I've got this problem where once in a while, when a user uses the one time password link, instead of going to the password reset page, it takes them to the home page. Whenever this happens, in the ...
- 1
1
vote
0
answers
18
views
How assign new simple_oauth scopes?
I've a problem with simple_oauth module and scopes, on a D 9.3.x site.
I'm using it to authenticate user in a decoupled front-end in Next.js.
The case is:
A (new) user log-in without roles expect ...
- 645
0
votes
0
answers
494
views
PHPMailer SMTP fails to authenticate against Exchange Online while using PHPMailer Oauth2 and an Azure AD application
I am attempting to use PHPMailer SMTP and Oauth2 to send mail via Exchange Online, but, despite PHPMailer Oauth2 being able to get an Auth Token from the Azure application, PHPMailer SMTP fails to ...
0
votes
0
answers
68
views
Simple OAuth + GraphQL authentication
I'm trying to set up a decoupled Drupal architecture with the GraphQL module and Gatsby static site builder. Following online guides for this setup, I also installed/configured Simple OAuth for ...
-3
votes
1
answer
83
views
How to make users stay logged in across devices? [closed]
https://api.drupal.org/api/drupal/core!modules!user!user.module/function/user_login_finalize/9.2.x regenerates the sessions each time the user logs in. This can become a little hassle if user for ...
- 37
0
votes
1
answer
145
views
Wrong user page loaded after user_login_finalize()/user_logout()
I have a third party login custom module that calls user_login_finalize() after authentication, and user_logout() upon logout. Both of these functionalities work except if the user logs in/out from ...
- 263
0
votes
0
answers
36
views
Does the "Simple OAuth (OAuth2) & OpenID Connect" module support integration with 3rd party Authorization servers?
Does Drupal "Simple OAuth (OAuth2) & OpenID Connect" module support authenticating Access Tokens (in JWT format) generated by a 3rd party Authorization server? We are using Client ...
- 11
1
vote
0
answers
47
views
"JSON Web Authentication (JWT)" module support for 3rd party JTW issuer
Does Drupal "JSON Web Authentication (JWT)" module support authenticating JWTs generated by a 3rd party JWT Issuer (rather than by the internal module's Issuer)?
- 11
0
votes
0
answers
201
views
Drupal Webform REST
I am trying to use Drupal Webform REST.
I got an error "The 'restful post webform_rest_submit' permission is required." on browser console. I have enabled modules and REST resources as ...
- 11
0
votes
1
answer
233
views
"There have been more than 5 failed login attempts for this account. It is temporarily blocked." and the flood table is empty
When I try to log in as an admin user, I am getting the following error:
There have been more than 5 failed login attempts for this account. It
is temporarily blocked. Try again later or request a ...
- 27k
0
votes
0
answers
339
views
LDAP integration not working with Drupal 9 (using Ludwig as a composer alternative - was working under Drupal 8)
I 'm having a problem since updating to Drupal 9, with regards to LDAP integration. Previously, while on Drupal 8, I had successfully integrated my schools LDAP for users authentication, using the ...
- 169
3
votes
3
answers
1k
views
AccessDeniedHttpException on a route with _access: TRUE
In my custom module I have a few "publication" routes that do not need any kind of authentication. Months ago I learnt that I could achieve this with the following requirements in routing....
0
votes
1
answer
116
views
Get client credentials from Simple Oauth module
I am creating user authentification with Drupal 9 + NuxtJS.
Using Simple Oauth module and create post requests to
oauth/token
with data
const data = {
grant_type: 'password',
client_id: '',
...
0
votes
2
answers
249
views
The sequence of actions upon cookie-authentication to Drupal site
There is a drupal 9 site that has a REST-endpoint that can be accessed for logged-in users (not for anonymous ones).
And, it's necessary to make a GET request to the endpoint using cookie ...
- 928
0
votes
0
answers
59
views
Getting 403 randomly on files
I have a react-native app that authenticates with Drupal via oAuth2 (simple_oauth, openidconnect) and do not use cookies. I use my access token for all rest calls, images and other files. Very ...
0
votes
0
answers
43
views
Unable to log in using Chrome browser
I having an issue with my Drupal site (8.9.19)
Using Firefox browser, there is no problem login for all users
However, when using Chrome - users are unable to access. This is what I received in the ...
2
votes
0
answers
32
views
Drupal access without authentication depending on the source network
Is it possible to avoid the login page depending on the user's network of origin? We have a Drupal setup that can be accessed from a VPN and from the internet. We would like to make it so that users ...
2
votes
0
answers
67
views
Should post requests revoke my access token when using Simple Oauth?
I'm using Simple Oauth (4.x) in a headless application which is working well. However, I have noticed that when doing a post request that my access token is revoked, and the next post request will ...
- 517
-1
votes
1
answer
68
views
Using Authentication API module
I'm trying to use the User Authentication API module. My goal is to add some post-processing after successful Drupal 7 login that posts JSON to an external web service. This would be work very similar ...
- 31
1
vote
0
answers
82
views
How can I allow users to change their email addresses without a password with JSON:API?
I have an Ionic React app and I want to allow users to change their email addresses.
However, when I try to change the email address in a PATCH request, I get the following error:
{
"jsonapi&...
- 27k
1
vote
1
answer
242
views
How can I implement sign in with Google / Apple for a decoupled site?
I have a decoupled Drupal site that uses JSON:API to serve an Ionic React app.
I'm currently using the JWT (JSON Web Token Authentication module to enable users to register and log in (alongside the ...
- 27k
0
votes
1
answer
37
views
Securing admin account, silly "solution" found
Hello fellow Drupalers,
I've been given the task of securing our admin account, on our websites (drupal 7) from outsiders.
My first thought was 2FA and I looked at some of the modules (tfa, google ...
- 141
0
votes
1
answer
1k
views
How to get current user jwt token?
In a custom module, I need to get the jwt token (access_token) related to the current user. Following this issue I've tried to get it, but without success, because get_jwt_key() and jwt_token_params() ...
- 612
0
votes
1
answer
110
views
How do I let users cancel their account with JWT / JSON:API?
I am making an Ionic app with Drupal as the backend. Users log in via JWT. I'm using JSON:API to send data to Ionic. Now I want to allow users to cancel their accounts in the app (by JSON:API) ...
- 27k
0
votes
1
answer
877
views
Success with cookie, fails with JWT: RuntimeException: Failed to start the session because headers have already been sent
My Controller is working with cookie auth but failing with JWT. This Controller is supposed to flag an entity for the logged-in user.
If I am using cookie auth, there are no errors and everything ...
- 27k
0
votes
1
answer
58
views
How do I allow only username for password reset form?
By default the password reset module allows 'Username OR E-mail'. I am using a module which allows multiple user accounts with a same email address (but usernames are unique and auto-generated), so ...
- 11
0
votes
1
answer
91
views
OAuth2 Server sending 'null' as the 'sub' parameter instead of User Id
When using OAuth2 Server module to authorize with users, I am not receiving the correct "sub" parameter in the response from the server. I get all the other fields such as email, ...
- 241
1
vote
0
answers
212
views
How to get a JWT token when not logged in
If I am logged in (have a session cookie) and make a GET request to /jwt/token, then I get a JWT token. How do I get the token if I am not logged in?
This article by Preston So states:
As a logged-...
- 27k
-1
votes
1
answer
150
views
Query user_field_data in Drupal
I need to query the user_field_data table to see if a user exists. Through a query string, I pass to a php script that is on the server username and password in clear text. This script connects to the ...
- 11
2
votes
1
answer
1k
views
Decoupled login: How do I get the session cookie via JavaScript?
In the Medium app, if you go to the settings tab, you can change some of the settings inside the app. But, if you try to change your email notification settings, it opens up a web browser inside the ...
- 27k
4
votes
2
answers
361
views
How to implement stateless authentication
I'm having a big problem with Drupal 8, I want Drupal to trust a downstream reverse proxy that performs authentication against a third party provider, then passes a JWT in a X_ID_TOKEN header.
As I ...
- 91
1
vote
1
answer
301
views
Programmatically log in a user
I am trying to authenticate users as below. I don't get any error, but it doesn't log in users.
autoLogin.php is located in the root folder. Visiting http://example.com/drupal8/autoLogin.php shows me ...
- 113
0
votes
1
answer
754
views
I cannot sign into my drupal site. The login page just refreshes and there are no error messages
I cannot login into any account from the login page. I can get to the admin page by doing drush user-login but if I log out of admin and try logging in again, the login page just refreshes and I do ...
- 39
1
vote
1
answer
936
views
JSON:API authorization
I'm at the early stages of trying to figure out the Drupal JSON API and can't figure out what's causing the following errors.
Some resources have been omitted because of insufficient authorization.
...
0
votes
1
answer
843
views
Issues trying to understand and debug simplesamlphp error
Simplesamlphp used to work on the site. Something changed and now it does not.
The IDP remote config has been verified, including the cert
The SP cert and pem in the simplesamlphp/config folder have ...
- 395