If you login as user foo, and exit the browser without logging out, then login again as foo2, you will be logged into drupal as the user foo. I'm assuming this is because of a cookie that keeps you logged in. The webserver auth module needs to check to see if $user->name matches $_SERVER["REMOTE_USER"].

I did this by putting the following code just before "if ($user->uid) {"

// make sure the drupal login name matches the name passed to the web server
if( $user->name != $_SERVER["REMOTE_USER"])
{
$user->uid='';
}

I am using this version of the module: // $Id: webserver_auth.module,v 1.13.2.3 2006/03/03 05:08:12 weitzman Exp $

Comments

moshe weitzman’s picture

moshe weitzman commented
Status: Needs review » Closed (works as designed)

those don't have to match. thats the point of the authmap table ... i don't know what the solution here is. we need some help from the authentication service (LDAP, .htaccess, etc.).

greensky’s picture

greensky commented
Status: Closed (works as designed) » Active

Well my initial experience with the incorrect user being logged in can't be correct can it? If I login as a user foo, close the browser, and re-log in with foo2, I'm logged in as foo. I don't see how this could be by design?

I can see how my idea won't work for all instances, but I think the main issue here is that there is no adequate way to make sure you are totally logged out of Drupal if this module is installed.

xxvelcrar’s picture

xxvelcrar commented

I suspect the proper solution would be to get Drupal to not remember the user and always rely on the external authentication system to provide the username.

I just tried it on the latest dev of the 5.x series and it seems to do the right thing now. Is this still a problem?

Paul Natsuo Kishimoto’s picture

Paul Natsuo Kishimoto commented
Status: Active » Closed (won't fix)

No, it's not; I think this behaviour changed from the 4.7.x series to the 5.x series.