I'm working on an ldap authentication module as part of the ldap project for drupal 7. Since other external authentication modules need to migrate to 7 and this functionality is critical to security, I wanted to get some feedback on d7 workflow, hooks and functions related to authentication.
Please let me know if there is other good discussion and resources on this besides api.drupal.org, http://api.drupal.org/api/drupal/modules--user--user.api.php/7, the drupal core issue queue, and http://drupal.org/update/modules/6/7 Or any d7 code from other external auth modules. If we get a good discussion here, I'm willing to write up the results in a sample module for http://drupal.org/project/examples or some documentation in http://drupal.org/developing/modules
I see at least two types of external authentication workflow:
1. Credentials entered in drupal: enter credentials on drupal site, module verifies, and logs user in.
2. Externally entered credentials: drupal login based on cookie, webserver, token etc such as kerberos, webserver authentication, open id.
I'm interested in case 1. for the ldap_authentication module. Below are my initial notes/psuedo code on workflow that I'm looking for feedback on.
/**
* Implementation of hook_form_FORM_ID_alter().
*/
function ldap_authentication_form_user_register_alter(&$form, $form_state) {
/**