CUWebAuth is Cornell's single sign on system. I wrote a module to use this to authenticate Drupal users.
- The module is called culauth and is located in sites/all/modules/custom where installed.
- The module is based on Adam Smith's work in the cul_common module. It uses cul_common's api for accessing LDAP data.
- culauth contains a form for the login dialog, a block to display the form in, various hooks to catch the login, and the login code
- To trigger the CUWebAuth authentication, culauth jumps to a .php file in a protected directory using drupal_goto. The directory is protected by a ,htaccess file containing this:
AuthName CORNELL
AuthType All
require permit library - The actual .php file adds a cookie that tells culauth what the user's netid is.
- Given the authorized netid, the module creates a Drupal user account with that netid. No roles are assigned to the user.
- Once the Drupal account is created, the authorized user can log in without a password - just click the log in button.
- The CUWebAuth cookie expires at the end of the browser session. To log in after browser restart the user should have to go through CUWebAuth again.
- With the default setup, the Drupal login session does not expire on browser restart. You can get in a situation where you are logged in to Drupal but there is no CUWebAuth cookie. This is not good.
- I added a module called Automated Logout that kills the session.