Externally authenticated users can have no email address

Thanks for the detailed report . Drupal's remote authentication method is a bit dated, IMNSHO. I doubt it will be changed much. Modules that expect mail addresses to be present should probably be fixed to do a check and/or the remote users be reminded to update their user info. Anybody wantes to send a patch?

There are several modules to allow diferent kinds of authentication, but what is the situation about core remote authentication?

This bug could use a bit more attention. With Drupals (Dries') intention to get openId integrated in core, this needs to be solved soon.

Here is a potential work-around that some folks might find useful until such time as the external authentication hooks are enhanced.

The scenario that my work-around addresses is this:

• I needed to build a custom auth module to authenticate Drupal users against a pre-existing application database. Of course, the current auth hook doesn't provide a facility to pass back the e-mail address to the user module such that the user module automatically adds the correct e-mail address when adding the user.
• Somewhat conveniently, users in my other application are identified by their e-mail addresses, so all that needs to be done is to duplicate the username field into the e-mail address field.

My authentication module is fairly simple. The first function looks after the external authentication (making sure the user has entered a user ID that includes a domain name) and the second function updates the e-mail address which, in this scenario, I can simply copy from the username. From reading the code in the user module (and the doco) I have found (in Drupal 5.1 anyway) that the user hook below is called AFTER the user has been inserted into the database. By only overwriting the e-mail address when it is blank we get the added benefit that locally added users (who, in all probability, will have a different username to their e-mail address) do NOT get their e-mail address overwritten by the user hook.

function myauth_auth($username, $password, $server)
{
    if ( empty( $server ))
    {
        return false;
    }
    
    $username .= '@' . $server; // $username = e-mail address

    $result = callExternalAPI($username, $password); // <-- Insert a call to some function to do the remote authentication (returns true or false)
    
    return $result;
}

function myauth_user( $op, &$edit, &$account, $category = null )
{
    if ( $op == 'insert' && empty( $account->mail )) // Checking if the e-mail address is empty avoids overwriting it for locally created users
    {
        db_query("UPDATE {users} SET mail = '%s' WHERE uid = %d", $account->name, $account->uid);
    }
}

Please note that the callExternalAPI() function above is simply a placeholder - you should obviously implement your own method, based on whatever design suits your architecture and your security requirements.

There are other use cases that this solution obviously doesn't address, like how to keep the credentials in sync between the two databases, but this is a start at least.

Hopefully this fairly straightforward solution will get a few people up and running with what I believe would be a fairly common integration scenario.

- James.

5.x version seems to have this issue too. This is really disappointing :(. Our LDAP has no e-mails filled on regular basis (really not at all). I thought initially that "OK, I will do the LDAP auth and everything will be fine", but didn't find any ways to require a users to specify their e-mail after they have login...
Any hacks against this issue?
Thanks a lot in advance!