Script to bootstrap and authenticate against Drupal, for Apache mod_auth_external.

drupal-authentication.php

#!/usr/bin/php
<?php

# Globals to hold status:
$drupal_bootstrapped = FALSE;
$authenticated = FALSE;

# Use a shutdown function to ensure that authentication does not go through
# if bootstrapping Drupal fails (because PHP's die() returns exit(0)):
function shutdown() {
  global $drupal_bootstrapped, $authenticated;
  if( $drupal_bootstrapped == FALSE ) exit(1);
  if( $authenticated == TRUE ) exit(0);
  exit(1);
}
register_shutdown_function( 'shutdown' );

# Check this is a shell call, not a server call:
empty($_SERVER['SHELL']) && die('shells only please');

# Add some mock variables to make Drupal happy:
$_SERVER['REMOTE_ADDR'] = '127.0.0.1';

# Bootstrap Drupal:
define('DRUPAL_ROOT', '/var/www/html/act');
require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);
$drupal_bootstrapped = TRUE;

# Get the credentials from STDIN:
$username = trim(fgets(STDIN));
$password = trim(fgets(STDIN));

# Authenticate using Drupal:
$auth = user_authenticate($username, $password);

# Record the result in the global scope:
if($auth) {
  $authenticated = TRUE;
}

# Exit, passing control to the shutdown function, using code 0 as 1 apparently cannot be overridden on shutdown:
exit(0);
?>

See also

• Drupal 7: Sharing authentication with HTTP-Auth
• mod_auth_external

This script is based on the answers to that Stack Overflow question, but I've added a shutdown handler to ensure that authentication does not work if bootstrapping Drupal fails.

Could you please confirm this is still working with drupal 7.32? We keep getting password mismatch error logs and our users can't log in using this system.