Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.The attached patch provides settings and form alteration to allow:
* Forcing user login when navigating to /user. This allows all currently existing links to "login" to still work, but point to CAS instead of Drupal.
-- Local login is still permitted via /user?locallogin
* Obfuscating the local login form so that users are not presented with the local Drupal login form. If enabled, it will put the local login form into a rollout.
This patch may not apply correctly without the patch 144870
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | 144872.txt | 1.7 KB | jrbeeman |
| cas_user_login_page.txt | 3.5 KB | jrbeeman |
Comments
Comment #1
metzlerd commentedSome of this functionality seems redundant. The require cas auth for specific pages text area covers this fucntionality in all my sites. You simple put in user* in the require cas login for specific pages and this works. I would prefer to handle all of these int he same way. Am I missing something here?
Comment #2
metzlerd commentedRegarding the obfuscation. I've recently developed and am in the process of getting ready for release a new module called formdefaults. You can find this in HEAD. Although I'd be willing to consider putting this patch in. Altering the text assoicated with the user login form seems more in the realm of the formdefaults module. You might consider taking a look at that, rather than overly cluttering the cas settings page with stuff about altering form defaults.
Would you be willing to look at this approach?
Comment #3
jrbeemanYes, I'd definitely like to look at form defaults - thanks for the info on it.
Regarding the "/user" url - the one argument for having a special setting to get to it is that providing user* as the argument doesn't allow for local logins to happen any more. I've found that there are times when I still need to login locally - to install modules, if CAS is down and I need to figure out why, etc.
Maybe the option should be changed to "Still allow local login?" and, if checked, would allow users to login via user?locallogin
Comment #4
metzlerd commentedOk, I guess I see. We want to block viewing user info /user/1 but still want to allow user/login. Yeah lets roll this as an "always allow local logins option, and I'll be happy to commit it.
Comment #5
jrbeemanNew patch attached that simplifies this feature request to 2 check boxes:
* Force CAS login on Drupal user login page
* Always allow local login
Comment #6
metzlerd commentedDon't understand why "force cas login" checkbox is required. This should just be handled with the specific pages option. I can understand the always allow user/login to get through. But having two features that control whether you'll be forced to login to specific pages seems confusing. Lets just list user/login in the specific pages and be done with it.
Also there's an outstanding feature request for changing the "specific pages" vs. "all pages" box to be "specific pages" vs. "all pages except..." This would let you do all pages except "user/login" and "rss/feeds" etc.
Comment #7
jrbeemanI saw a patch was recently committed to add the "all pages except..." option. That is definitely a better solution. I've marked this as "minor" and "won't fix". Feel free to close, if you like.