Problem: Using webserver_auth to automatically login a user authenticated externally via the webserver (and presented to Drupal with $REMOTE_USER set). However, watchdog is showing content being accessed by user "anonymous." Why?
Shouldn't the webserver_auth module always ensure someone is logged in? This is not a problem for most people accessing content but is a problem if someone wants to add a comment to a node (they are asked to login).
The only node in which webserver_auth works (aligns externally authenticated id with drupal id) is via the home page for the site. If user clicks a node url in an email invoking a new browser session the webserver's external authentication method is invoked but webserver_auth is not aligning external id with a drupal id.
Background: Webserver_auth aligns an external webserver session with a drupal id using authmap. $REMOTE_USER is queried in authmap which results in the drupal id being returned (or creates one if it does not exist).
Analysis:
When using webserver_auth a non-persistent session cookie is used. It expires upon termination of the browser. This is a good thing because you only want access granted via the webserver authentication and not a persistent session cookie from drupal.
Webserver_auth is invoked via an "init" hook, using module_init(). This hook is only invoked in common.inc. Apparently, an "init" hook is only sent when the default home page is referenced. When accessing other nodes an "init" hook is never invoked.
Should the "init" hook always be invoked? For all nodes?
Possible fixes:
Ensure "init" hook is always invoked, for all nodes.
Use persistent cookies (not preferred).