17

Drupal supports external authentication. There are many alternatives authentication modules for Drupal, such as OpenID (included in core), OAuth Connector, or LDAP. Learn more about how Drupal authentication works; the best would be to look at the OpenID and OAuth modules, and to the core login form submit callback. But, AFAIK, they always start the normal ...


9

So the default assumption most Drupal modules make with authentication is that they will replace the current login setup with their own. This approach is described well in http://drupal.org/node/114774#dist-auth and can be seen in how the current openid module provided in Drupal core works. If I understand your question correctly you want to provide a way ...


8

Does the HybridAuth Social Sign-on not fit your requirements? This module integrates HybridAuth library into Drupal and allows your users to login and register using Google, Facebook, Twitter, Yahoo, MySpace, Windows Live, LinkedIn, Foursquare, AOL, OpenID and more. Additional providers include: Github, Gowalla, LastFM, Vimeo, Disqus, Instagram, Viadeo,...


6

I think you're desire to use Oauth is justified. However, if you have no other options, you can use Cookie authentication. I have used it before and have heard of people using it as well. Here are some things to keep in mind and you'd be good to go with Cookie auth with your mobile application: You will have to increase the session timeout time to a long ...


5

Yes! You should consider Drupal 6 without phpass to be unnecessarily insecure. And yes, you should use phpass on all your D6 apps. There are reasons they've changed the way things work in Drupal 7, and made the same changes available as a module to D6 users. There is no silver bullet, but there's no reason to ignore an easy-to-use module that will ...


5

I simple solution would be to alter the login form to remove the username and password fields. Here is some sample code to get you started: /** * Alter the login form page */ function MYMODULE_form_user_login_alter(&$form, &$form_state, $form_id) { _MYMODULE_alter_login_form($form); } /** * Alter the login form block */ function ...


4

You will never be able to use Drupal's core user module without using the database's user table (and many others), without seriously modifying core Drupal. It sounds like the only reason you want Drupal to not use it's own user + roles + permissions management (and all of the other contributed Drupal modules that depend on the user module) is so that if a ...


4

Bakery doesn't pre-sync accounts, so any accounts that exist only on slave sites (sub-sites) won't be synchronized to the master site. This is because of the nature of needing an authoritative account master, the Bakery master site. During authentication (on a slave site) Bakery sends the user to the master to validate so if the account does not exist there ...


4

To hide the password fields on the user edit form, put this code in your custom module, which implements hook_form_FORM_ID_alter(): function YOURMODULE_form_user_profile_form_alter(&$form, &$form_state, $form_id) { hide($form['account']['pass']); } You may also want to prevent users from going to user/password page and change their passwords on ...


4

There are two template files used hybridauth_widget.tpl.php This one is used to create the list of the icons. It gets a variable called $providers which has all the enabled providers. hybridauth_provider_icon.tpl.php This one is used to print the individual icons. Two variables are used here. $provider_name is the name of the provider like facebook ...


4

We had the same exact issue using the above configuration. It turned out that I had a rule enabled to redirect the user to a page upon login. When I disabled the above rule everything went back to normal Probably a conflict between modules. Thanks, Leonidas


4

To check login credentials in Drupal 6&7: $uid = user_authenticate($username, $password); In Drupal 8: // Inject user.auth service.. $uid = $this->userAuth->authenticate($username, $password); // or $uid = \Drupal::service('user.auth')->authenticate($username, $password); To check roles: /** * Check User roles * @param $role * @param ...


4

You'll want to create a custom module, please see https://www.drupal.org/node/1074360 You can then implement hook_mail_alter(). /** * Implements hook_mail_alter(). */ function my_module_mail_alter(&$message) { // Alter password reset if ($message['id'] == 'user_password_reset') { // Load the user by email address if ($user = ...


4

To provide the page hosting the React SPA, you will need to implement a custom module. This module would also contains all the JavaScript code of your application. If that's the only usage of React in your site, I suggest bundling everything in the module to make it easier. I assume you should be able to retrieve the user authentication token and any other ...


3

You should read the official security thread, if you want to go further I advice you to take a look at the cracking Drupal book. In chapter 1, which is available for free download, you will get an idea of the places to look at. According to this book, most common vulnerabilities found in Drupal sites are : Vulnerability | occurences as a percentage ...


3

Stack Exchange uses OpenID for single-sign-on, which is not the same as OAuth. The good news is, OpenID is built-in to Drupal core. The downside of using the core module is your visitors must know the URL of their OpenID provider. Most people already have at least one OpenID provider, but don't know it. To solve this problem, you could try OpenID ...


3

IMHO, integration of different system through form POSting is at the hack level. To let external system inject data into Drupal, the Services module let you easily build HTTP REST API in Drupal. It comes out of the box with a user API that allow external system to easily create new Drupal users. Off course, you can create your own page to receive POSTed ...


3

You can try the Drupal Services, REST Server and 3-legged OAuth tutorial here. Just be pay intention in this part : $oauth->fetch("$api_url/node/1"); This is just for creating the GET request. If you want to create the POST request. It should be something like. $oauth->fetch("$api_url/user/vote.json",array('nid'=>10),OAUTH_HTTP_METHOD_POST);


3

The last time I looked into BBNC (which was two or three years ago), you had to do a two-fold approach. First, you need to write an ASP.NET webservice on the BBNC side using their API to expose login. This may have changed since I checked it out. Poke around the BBNC forums to see what may already exists. Two, you wire up authenticate against a non-...


3

You are getting 404 error because actually there is no page in your site with that url. In your referenced tutorial the following statements can found as a note: " Note: The sample callback URL above is incorrectly shown. The callback URL should be an URL on the client side. When Drupal has authorized the consumer, it will call this URL with the access ...


3

Check your setup.php, probably you should set the baseurl variable there, since your drupal root is not the default /var/www


3

Have you ever try to use OAuth Connector. It allows us to create the comsumer/application/connection to Twitter, Facebook... or another Drupal website. For my own purpose. I used that for fetch the data from Drupal 6 Services 3 by using this module in Drupal 7 and some extra code and it worked fine.


3

I've worked with LDAP and i have done a function on cron execution, to create automaticly user (of a certain role) who are not already created by login I hope this will help you function _synchro_ldap(){ $server = "serveur.com"; $rootdn = "name"; $rootpw = "pwd"; $ds = ldap_connect( $server ); $r = ldap_bind( $ds, $rootdn, $rootpw ); $dn = "...


3

Assuming Drupal 7, if you are trying to override LT's toboggan/denied page, eg, what overall structure you see when you land on www.example.com/toboggan/denied, you could copy your theme's page.tpl.php to page--toboggan--denied.tpl.php and modify whatever you wanted in there. (If Drupal 6, the new name would be page-toboggan-denied.tpl.php.) If you are ...


3

The LinkedIn Integration module won't automatically create a new user account for you. From step 5 of the directions in the module's README: Usage : Users will have to associate their LinkedIn account with their local Drupal account (at user/%user/edit/linkedin) to use any functionality provided by submodules. So if you log in via LinkedIn with a ...


3

It turns out that "Clean URLs" need to be turned on for OpenID... I added "AllowOverride All" to the section under VirtualHost in my Apache config file. This allowed me to turn on Clean URLs and the error is now gone.


3

1- build the content structure well in your first site and create a view from admin/structure/views/add that return the data needed to the second site which acts like a client consuming your first site content. 2- Download and enable Services module and enable the submodule Rest Server and submodule OAuth Authentication now you can create secured resources ...


2

If you disable email notification of new accounts, the OpenID module will set a random password when users register. See openid_form_user_register_form_alter(). If that is not what you want, you use hook_form_alter() to do the same thing under your desired conditions. If you want to intercept user_pass_reset() so it cannot reset passwords, try using ...


2

The OAuth Connector module for Drupal 7 claims to be supporting signing up and logging in through OAuth 2 API:s in general and also to support Facebook specifically.


2

To configure LDAP with Drupal 7, you'll have to install and configure LDAP module (including ldap_authentication and ldap_user). Once enabled, you'll find the configuration at /admin/config/people/ldap. First of all, you'll have to add and configure your 'LDAP Server Configuration' depending on your LDAP configuration (Servers tab at /admin/config/people/...


Only top voted, non community-wiki answers of a minimum length are eligible