Drupal6

This module performs two functions:

1. Check to see if an existing, valid Drupal session cookie is defined.
2. Perform basic username and password lookup in a Drupal6 database.

The second step is performed only if there is no existing Drupal session cookie available and only if the allow_login parameter is enabled.

The following Drupal tables are accessed:

• users
• sessions

You will typically need login to the database as the database owner and grant the webserver user read access to these tables, e.g.:

postgres# GRANT SELECT ON users TO "www-data";
postgres# GRANT SELECT ON sessions TO "www-data";

Example configuration:

<jarvis>
    <app>
        <login module="Jarvis::Login::Drupal6">
            <parameter name="allow_login" value="yes"/>
            <parameter name="admin_only"  value="yes"/>
            <parameter name="admin_group" value="admin"/>
        </login>
        ...

The parameters are:

The determined group list is:

• <admin_group> For the user with uid = 1.
• <role1>,<role2> For all other users, taken from the users_roles table.

Note: When this module is used to login, any dataset requests will also have access to the following additional variables:

• __uid

This variable contains the UID value from the Drupal6 users table. It can be accessed in a dataset e.g. by specifying {$__uid}. This is a “safe” variables in the same sense as e.g. the __username variable in that it is set purely by Jarvis and cannot be set or modified by the remote client.

Login Type Drupal

When using login_type=drupal, you must have an existing Drupal session in order to perform a Jarvis login. With this setting, Jarvis will never accept a username and password. Only Drupal may perform the username and password validation.

Jarvis performs its validation by looking for a Drupal session cookie and comparing it against list of cookies in the sessions table of the Drupal database.

Note: Currently the Drupal database must be the same database which Jarvis uses for fetching data for dataset requests. In the future, the Drupal6 module may allow you to specify a different database connection path for user validation.

Note: When using Login Type drupal you most likely will want to disable the Jarvis session database, by removing the <sessiondb> tag from your application configuration file. This is so that if the user logs out of Drupal, or changes their Drupal username by re-logging, then Jarvis will immediately detect this change.

Login Type Jarvis

When using login_type=jarvis, then Jarvis will ignore any existing Drupal session. Instead, you must create a Jarvis session by providing the username and password of a valid Drupal user. The username and password are checked against the Drupal6 database, but Jarvis will never create a Drupal6 session.

Jarvis will create its own session, stored in the session database configured by the <sessiondb> tag. This session remains entirely independent of any Drupal session that may be created by logging in to Drupal. Logging out of Drupal will not affect your access to Jarvis so long as the Jarvis cookie remains valid.