What works:
External authentication for new users.

What does not work:
External authentication for existing users. The $user global variable never gets set in the event a valid user is returned through user_load.

CommentFileSizeAuthor
#9 fix-external-auth.patch468 bytesbdrieu
#2 283026-auth-without-server-part.patch2.54 KBdamien tournoud

Comments

damien tournoud’s picture

damien tournoud commented
Status: Active » Postponed (maintainer needs more info)

Which authentication module are you referring to?

damien tournoud’s picture

damien tournoud commented
Title: user_authenticate from external source (for existing users) not working » user_authenticate from external source (for existing users) not working with no server part
Version: 5.8 » 5.x-dev
Status: Postponed (maintainer needs more info) » Needs review
StatusFileSize
new 283026-auth-without-server-part.patch2.54 KB

The issue is that user_authenticate does not allow to build an authentication module where user has no server part since #165642: error in SQL syntax in user.module on line 368 (or 378) came in.

After discussion with the security team, we came to the conclusion that we could very well manage that.

Here is a patch against 5.x-dev. Later versions are not affected.

damien tournoud’s picture

damien tournoud commented

#283698: External user authentication broke in 5.8 update was a duplicate.

Also, please note that authentication modules that does not use a "server part" (users in the form name@server) will have to rebuild manually the authmap table for users they manage.

damien tournoud’s picture

damien tournoud commented

#283804: Login with external authentication was another duplicate.

vangorra’s picture

vangorra commented

I'm referring to the user module and the user_authenticate function. This is what I did as a work around until the core source is updated.

$registered_user = user_load(array('name' => $name));
if (!$registered_user->uid) { // Register this new user.
$userinfo = array(
'name' => $name,
'pass' => user_password(),
'init' => $name,
'status' => 1,
'access' => time(),
);
if ($server) {
$userinfo["authname_$module"] = $name;
}
$user = user_save('', $userinfo);
watchdog('user', t('New external user: %user using module %module.', array('%user' => $name, '%module' => $module)), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $user->uid .'/edit'));
break;
} else {
$user = $registered_user;
break;
}

damien tournoud’s picture

damien tournoud commented

#286642: Error processing external authentication sources was a new duplicate.

damien tournoud’s picture

damien tournoud commented

@vangorra: the behavior of the user_authenticate() in Drupal 5.8/5.9 is the good one (user_authenticate should *not* authenticate local users that are not in the authentication map).

Which authentication module are you trying to use?

vangorra’s picture

vangorra commented

I'm using my own authentication module. I wrote it against the Drupal < 5.8 API. The scenario that is troublesome is an external user changes their password on the external source. How the function is written now, Drupal will return an authentication failure even though my auth module returns success. Non-existing external users, however will be registered correctly.

bdrieu’s picture

bdrieu commented
StatusFileSize
new fix-external-auth.patch468 bytes

I have the same problem.

I created a authentification module for Drupal, which worked fine until drupal 5.8. I made this patch (about the same as vangorra's).

@Damien: if using foo_auth to authenticate local users not in the authentication map has been made obsolete, what is the method that supersede that behaviour?

Anonymous’s picture

Anonymous (not verified) commented

bookmark

scb’s picture

scb commented

I have the same problem, with a module implementing hook_auth.
New users are authenticated ok and created in the users table, but when you try to login again with the same user, it doesn't authenticate, even hook_auth returns true.
Applying the patch in #9 seems to solve the issue, but throws some warnings... I'll take a look at it to give more info.

cridenour’s picture

cridenour commented
Status: Needs review » Reviewed & tested by the community

Before patch, subsequent logins were not working.

After patch, they are. No effect to initial login.

Please commit :)

EDIT: This was referring to Damien's original patch.

janusman’s picture

janusman commented

The patch from #2 worked for me when applied to D5-10 --- **BUT** first I had to create entries in the authmap table for every existing user that was created from external authentication.

New users (authenticated externally) are now being created as they should, along with their authmap table entry.

If you have existing users that were created with both internal and external authentication, you might have decide which one goes in the authmap table manually... =(

cridenour’s picture

cridenour commented

Yes, so the sooner this patch gets out there, the less work it will be ;)

bigheadfish’s picture

bigheadfish commented

I have the same problem:

http://drupal.org/node/305568

drumm’s picture

drumm
he/him
Location NY, US
commented
Status: Reviewed & tested by the community » Fixed

Committed to 5.x.

Anonymous’s picture

Anonymous (not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.