A list of questions and problems with Distributed Authentication in 4.5.2

I dunno if this helps, but I pulled this from the admin/help in 4.6:

-------------------
Distributed authentication

One of the more tedious moments in visiting a new website is filling out the registration form. The reg form provides helpful information to the website owner, but not much value for the user. The value for the end user is usually the ability to post a messages or receive personalized news, etc. Distributed authentication (DA) gives the user what they want without having to fill out the reg form. Removing this obstacle yields more registered and active users for the website.

DA enables a new user to input a username and password into the login box and immediately be recognized, even if that user never registered on your site. This works because Drupal knows how to communicate with external registration databases. For example, lets say that your new user 'Joe' is already a registered member of Delphi Forums. If your Drupal has the delphi module installed, then Drupal will inform Joe on the registration and login screens that he may login with his Delphi ID instead of registering with your Drupal instance. Joe likes that idea, and logs in with a username of joe@remote.delphiforums.com and his usual Delphi password. Drupal then communicates with remote.delphiforums.com (usually using XML, HTTP-POST, or SOAP) behind the scenes and asks "is this password for username=joe?" If Delphi replies yes, then Drupal will create a new local account for joe and log joe into it. Joe may keep on logging into your Drupal instance in the same manner, and he will be logged into the same joe@remote.delphiforums.com account.

One key element of DA is the 'authmap' table, which maps a user's authname (e.g. joe@remote.delphiforums.com) to his local UID (i.e. user identification number). This map is checked whenever a user successfully logs into an external authentication source. Once Drupal knows that the current user is definitely joe@remote.delphiforums.com (because Delphi says so), he looks up Joe's UID and logs Joe into that account.

To disable distributed authentication, simply disable or remove all DA modules. For a virgin install, that means removing/disabling the jabber module and the drupal module.
-------------------

Anisa.

------------------------------------------
www.animecards.org

14,702 card scans and counting!
------------------------------------------

I happen to be in somewhat the same situation and I did not have any problems finding the information that I was looking for. The API doc on drupaldocs.org documents the authentication hook and should provide a starting point.

What basically happens is this:

Create your own module and hake a function yourmodule_auth($username, $password, $server) in which you do your magic. Return false if you dont see a reason to authenticat the user (note that other modules still might!) or true of you decide that his credentials are valid.

For example, the following code fragment might illustrate a bit.

define('MYSERVER', 'leune.org');
function my_auth($username, $password, $server) {
    if ($server != MYSERVER) return false;

    $authenticated = my_fancy_authentication_function($user, $password);
    if ($authenticated) return true;
    return false;
}

Drupal then creates a new user account for username@server and adds an entry in the authmap table , which is pretty straightforward. From then on, a new drupal user exists, but authentication is handled by your module.

To answer your questions:

Where are the drupalids stored? When are they created? how are conflicts resolved?

- drupalids are stored in the database. That's really all you should know, but they are in the users table.

- They are created when you first authenticate with an external user.

- There are no conflicts, since the new username will contain @server.

What is the criteria for DA to work? There always seems to be a problem with using logins between sites. Like at the moment drupal.org users can use there drupalid on my site but my site users cannot use their drupalid on drupal .org

Distributed authentication is not symmetric; i.e. if two sites A and B want to authenticate eachother's users, both need to implement an external authentication.

What modules are responsible for DA.

I dont know; I use my own module for that; however the drupal module comes to mind. I also read something about a jabber module a while back.

Is DA effected by SSL?

It shouldn't. Drupal is a PHP application, and PHP knows nothing of the underlaying transport mechanism.

Hope I interpreted your questions correctly and gave a somewhat useful response.

carl - are you volunteering to enhance the documentation once these answers are provided? anyone else?