External Authentication: The SIMPLEST thing that could possibly work?

[cowboyd]

Hi there,

I'm migrating our current forum from drupal to vbulletin. Our main user database and profile data is in a java application running in the same domain. I've successfully integrated (mostly) our users but I'm running up against some problems when it comes to authenticating the user.

The way it works is this:

All the users in the java application have a forumId field which contains the vbulletin userid of that user's corresponding forum account. There is a REST api in the java application for converting a sessionids into forumId.

So, I wrote a little php hook in drupal to read the sessionid from a cookie (set by the main java application), then make the REST call to the java app to convert the sessionid into a userid, and then, load the user into the php request based on that id (if no id is found, then just load the anonymous user)

Now that I have the userid, I know they must have already been authenticated by the main application to have gotten a valid session id, so I don't need to do any other form of authentication. I know which user, and I know that they're authenticated, so I just want to have everything else just use that user.

I don't want vbulletin to do login at all. I don't want it to collect the username/password at all. I never want it to show a login form of any kind. I just want it to take the id it gets back from the java application and handle the request as though that user was logged in the entire time.

In cases where a login is required, I want it to redirect to the java application.

Does this clarify things?