This patch adds an authentication to drupal's web service so clients accessing xmlrpc.php don't always have to be Anonymous. Implementation is simple:

1. Client requests an authentication token, basically a session id
2. Drupal checks their crudentials (username/password) (system.getToken) and returns a token (same as a PHP session id). This is the same as a login through user/login, the current session id (Anonymous) becomes a user.
3. All subsequent requests sent by the web service client go to: /xmlrpc.php?token={session id}
4. xmlrpc.php was modified to recreate the session with the logged in user.

5. Unrelated, but felt compelled to fix. At the end of an anonymous xml-rpc request, the record from {sessions} is removed from the db. Not sure if this would break anybody's functionality, but it seems strange to me to keep that session id around.

CommentFileSizeAuthor
#3 xmlrpc_5.1.patch2.47 KBivanfi
xmlrpc_10.patch2.64 KBphrax
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

moshe weitzman’s picture

moshe weitzman CreditAttribution: moshe weitzman commented

this looks like a reasonable implementation to me ... i don't like #5 since some modules rely on session data even for anon users.

coreb’s picture

coreb CreditAttribution: coreb commented
Version: x.y.z » 6.x-dev
ivanfi’s picture

ivanfi CreditAttribution: ivanfi commented
Version: 6.x-dev » 5.1
FileSize
xmlrpc_5.1.patch2.47 KB

I have tried to apply this patch on Drupal 5.1, but I had to make some small modifications to make it work. See the attached patch, which is an updated version of the original, although without item #5 of the original post.

ivanfi’s picture

ivanfi CreditAttribution: ivanfi commented
Version: 5.1 » 6.x-dev

I'm setting back the version to 6.x-dev, since I did not mean to make this a feature request for 5.1, just wanted to share the patch for Drupal 5.1 in case somebody needs it.

catch’s picture

catch
he/him
Primary language English
CreditAttribution: catch commented
Version: 6.x-dev » 7.x-dev
Status: Needs review » Needs work

No longer applies.

moshe weitzman’s picture

moshe weitzman CreditAttribution: moshe weitzman commented

Ideally Drupal will implement the new OAuth spec for this - http://oauth.net/

Zothos’s picture

Zothos CreditAttribution: Zothos commented

OAuth doenst seem to be ready at the moment. But its a real nice idea definitly something for drupal 7

ankit_singh’s picture

ankit_singh CreditAttribution: ankit_singh commented
Title: Adding authentication ability to drupal's web service » Web Service for User Login
Version: 7.x-dev » 5.7
Component: base system » user system
Category: feature » support
Priority: Normal » Critical
Status: Needs work » Postponed (maintainer needs more info)

Hi Guys

I am sorry I dont have so much deep knowledge in Technical like you guys.

I am currently facing 1 problem.

I am using Drupal 5.7 version now and i made 3 websites for different purposes but now i am thinking of making some web service in Java Which will provide a common login for all 3 websites.

Now i am reading about Service module but still cant figure it out how to implement it.

So is it possible to do like this and please can anybody guide me and how i should implement this patch??

Quick reply will be really appreciated.

Thanks to all in advance.

REgards

Ankit

catch’s picture

catch
he/him
Primary language English
CreditAttribution: catch commented
Version: 5.7 » 7.x-dev
Component: user system » base system
Category: support » feature
Priority: Critical » Normal
Status: Postponed (maintainer needs more info) » Needs work

Ankit, please don't hijack hijack old issues for new support requests. A list of places to find support can be found at http://drupal.org/support

greg.harvey’s picture

greg.harvey
Primary language English
CreditAttribution: greg.harvey commented

This effort is being duplicated by the Services module, which doesn't seem sensible. Have you had a look at the User Service?
http://drupal.org/project/services

moshe weitzman’s picture

moshe weitzman CreditAttribution: moshe weitzman commented

It is quite common for functionality to start in Contrib and then find its way to core. Quite sensible, and common.

greg.harvey’s picture

greg.harvey
Primary language English
CreditAttribution: greg.harvey commented

Oh, yes - I don't dispute that for an instant - but these seem to be separate efforts, not contrib becoming core...? I'm suggesting there could be some liaison with the Services guys - I'm not making any comment on development paths in general... just this one.

It might be that the Services guys can remove their login/logout methods from their D7 version, but if there's no communication and you're both building the same thing...! See my point?

eeriepanda’s picture

eeriepanda CreditAttribution: eeriepanda commented

Many xmlrpc clients support cookies, why not just user_xmlrpc() {} and write a user_login wrapper function for it.

catch’s picture

catch
he/him
Primary language English
CreditAttribution: catch commented
Version: 7.x-dev » 8.x-dev

Moving to D8.

sanseo’s picture

sanseo CreditAttribution: sanseo commented

Hi
i have just configure a drupal a/c here http://webhosting.ueuo.com/drupal/
but after login admin a/c a m not able to do anything,
always massage come "You are not authorized to access this page."

will u help me............

fgm’s picture

fgm
Primary language French
Location Paris, France
CreditAttribution: fgm commented

@eeriepanda #15: because, as your own comment implies, some xml-rpc clients do /not/ support cookies.

This being said I think we will need to have a serious discussion as soon as reasonable (too bad it couldn't be during DC Chicago) about what we are doing in D8 to unify the usual browser login, OAuth access, and the various web services implementations, from core xml-rpc to the still-vaporware rpc-over-smtp or native SOAP over HTTP, through all the features in Services module, including services and servers.

@sanseo #17 : this does not seem to be related to this issue, does it ?

dawehner’s picture

dawehner
Primary language German
CreditAttribution: dawehner as a volunteer commented
Component: base system » rest.module
Issue summary: View changes
Wim Leers’s picture

Wim Leers
Location Ghent 🇧🇪🇪🇺
CreditAttribution: Wim Leers at Acquia commented
Status: Needs work » Closed (duplicate)
Related issues: +#2403307: RPC endpoints for user authentication: log in, check login status, log out

By now, this is a duplicate of #2403307: RPC endpoints for user authentication: log in, check login status, log out.