# OAuth2 integration with Drupal
**URL:** https://meta.discourse.org/t/oauth2-integration-with-drupal/43652
**Category:** SSO
**Tags:** oauth2
**Created:** [May 4, 2016, 4:08am UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652 "2016-05-04T04:08:47Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@tarek](https://meta.discourse.org/u/tarek)
#### Post date: [May 4, 2016, 4:08am UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/1 "2016-05-04T04:08:47Z")
**Special thanks to @dashohoxha for his help!!**
Continuing the discussion from [OAuth2 Basic Support](https://meta.discourse.org/t/oauth2-basic-support/33879/59):
I will use this thread to document my steps and progress in integrating Discourse and Drupal via OAuth2.
At present, the status of my implementation is **WORKING**.
**Installation on Discourse** :
For installation on Discourse, do the following:
1. Install [OAuth2 Basic plugin](https://github.com/discourse/discourse-oauth2-basic) as per [this thread](https://meta.discourse.org/t/oauth2-basic-support). See [Install a plugin](https://meta.discourse.org/t/install-a-plugin/19157) for details on how to install a plugin
2. Configure OAuth2 plugin:
- You should see an “OAuth2” section in “Login” in Settings when logged in as an administrative user.
- Enable “Custom OAuth2 is enabled”
- Set client ID as “discourse”.
- Create a client secret that is a random series of letters and numbers. You can use `apg -a 0 -m 20` to generate one.
- **oauth2 authorize url** : `https://DRUPAL/oauth2/authorize` where DRUPAL = your Drupal site’s base URL
- **oauth2 token url** : `https://DRUPAL/oauth2/token`
- **oauth2 user json url** : `https://DRUPAL/oauth2/user_profile.json`
- **oauth2 json user id path** : `uid`
- **oauth2 json username** : `name`
- **oauth2 json name path** :[You can leave this blank]
- **oauth2 json email path** : `mail`
- **oauth2 email verified** : [Check this on]
When you hit ‘login’, you should now see a ‘login with OAuth2’ option.
**Installation on Drupal**
1. Install the following plugins:
- [OAuth2 Login Provider](https://www.drupal.org/project/oauth2_loginprovider)
- [OAuth2 Server](https://www.drupal.org/project/oauth2_server)
- [Services](https://www.drupal.org/project/services)
- [REST Server](https://www.drupal.org/project/rest_server)
1. Add client at `/oauth2-servers/manage/oauth2/clients`
- Call the client `discourse`
- Enter the same client secret as above
- Set **Redirect URIs** as `http://DISCOURSE/auth/oauth2_basic/callback` where DISCOURSE = your discourse forum’s base URL
**Status and Known Issues** :
If you follow the steps above, you should see a “with OAuth2” badge on the login screen. Clicking on it should redirect you to your Drupal site for login that asks “Authorize discourse to use your account?” Clicking “Yes” results in either association to an existing account with the same email or creation of a new account with that email.
**STATUS: WORKING**
**KNOWN ISSUES:**
- Must be authorized with each login.
- Does not honour ‘groups’ / ‘roles’
tarek : )
---
### Author:  [@dashohoxha](https://meta.discourse.org/u/dashohoxha)
#### Post date: [May 4, 2016, 8:36am UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/2 "2016-05-04T08:36:02Z")
Are you sure that this is the correct Redirect URI?
> [@](#):
>
> [http://DISCOURSE/auth/oauth2\_basic/callback](http://DISCOURSE/auth/oauth2_basic/callback)
What does it do? Where is its code?
---
### Author:  [@tarek](https://meta.discourse.org/u/tarek)
#### Post date: [May 4, 2016, 11:27pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/3 "2016-05-04T23:27:36Z")
This is correct. Quoting directly from the install guide for [OAuth2 Basic](https://meta.discourse.org/t/oauth2-basic-support/33879):
> [@Discourse OAuth2 Basic](https://meta.discourse.org/t/discourse-oauth2-basic/33879/1):
>
> It will require a Redirect URI which should be:
> http://DISCOURSE\_HOST/auth/oauth2\_basic/callback
---
### Author:  [@tarek](https://meta.discourse.org/u/tarek)
#### Post date: [May 5, 2016, 3:12pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/4 "2016-05-05T15:12:55Z")
OK, there seems to be some good information from the maker of the Drupal plugin (@dashohoxha) in response to my [filed bug](https://www.drupal.org/node/2718525):
> [@dashohoxha](#):
>
> In the Drupal logs you have `GET /oauth2/user/profile HTTP/1.1`, but the homepage of oauth2\_loginprovider explicitly says that you need a POST request:
>
> > clients can access the user profile with a POST request at: [https://server.example.org/oauth2/user/profile](https://server.example.org/oauth2/user/profile) (after being authenticated and having an access\_token).
So, I will look and see if there’s a way to make this POST instead of GET.
tarek : )
---
### Author:  [@tarek](https://meta.discourse.org/u/tarek)
#### Post date: [May 5, 2016, 3:39pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/5 "2016-05-05T15:39:44Z")
It appears that there is no way to force POST instead of GET. I have [filed this as a bug](https://meta.discourse.org/t/omniauth-callback-does-not-support-post-only-get/43741).
UPDATE: Bug invalid. Refiled as a [bug in OAuth2 Basic](https://meta.discourse.org/t/oauth2-basic-support/33879/60)
tarek : )
---
### Author:  [@dashohoxha](https://meta.discourse.org/u/dashohoxha)
#### Post date: [May 5, 2016, 3:46pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/6 "2016-05-05T15:46:16Z")
> [@tarek](#):
>
> So, I will look and see if there’s a way to make this POST instead of GET.
Near the top of the other thread about oauth2, I saw something related to sending the header “Authentication: Bearer \” to the server. Maybe this is what you are looking for.
Otherwise you have to look at the code or ask the other guys about how it works, and maybe fix it.
---
### Author:  [@tarek](https://meta.discourse.org/u/tarek)
#### Post date: [May 5, 2016, 4:11pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/7 "2016-05-05T16:11:18Z")
> [@dashohoxha](#):
>
> Near the top of the other thread about oauth2, I saw something related to sending the header "Authentication: Bearer " to the server. Maybe this is what you are looking for.Otherwise you have to look at the code or ask the other guys about how it works, and maybe fix it.
This is an option that doesn’t seem to change the GET vs. POST behaviour. I just tried.
tarek : )
---
### Author:  [@tarek](https://meta.discourse.org/u/tarek)
#### Post date: [May 5, 2016, 5:03pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/8 "2016-05-05T17:03:10Z")
@dashohoxha Would you consider adding GET support to OAuth2\_loginprovider?
I have [filed a bug with OAuth2 basic](https://meta.discourse.org/t/oauth2-basic-support/33879/60) to ask for them to add POST support.
tarek : )
---
### Author:  [@dashohoxha](https://meta.discourse.org/u/dashohoxha)
#### Post date: [May 5, 2016, 5:28pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/9 "2016-05-05T17:28:19Z")
I can try it, but I am not sure whether it will work and how long it will take.
---
### Author:  [@tarek](https://meta.discourse.org/u/tarek)
#### Post date: [May 5, 2016, 5:52pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/10 "2016-05-05T17:52:13Z")
Excellent!!
In the meantime, I am trying to get a Ruby dev environment to figure out how to do this.
tarek : )
---
### Author:  [@tarek](https://meta.discourse.org/u/tarek)
#### Post date: [May 5, 2016, 7:36pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/11 "2016-05-05T19:36:30Z")
Ok, I have success!!! However, @dashohoxha, I’m not sure how to figure out the output of user/profile in OAuth2\_loginprovider.. Could you give me some advice?
See [Discourse OAuth2 Basic - #65](https://meta.discourse.org/t/oauth2-basic-support/33879/65) for the patch to make this work.
tarek : )
---
### Author:  [@dashohoxha](https://meta.discourse.org/u/dashohoxha)
#### Post date: [May 5, 2016, 9:06pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/12 "2016-05-05T21:06:54Z")
> [@tarek](#):
>
> I’m not sure how to figure out the output of user/profile in OAuth2\_loginprovider
The output should be a JSON that contains the fields of the user profile. Can you print it somewhere for debugging? I am not familiar with RoR, so I cannot help you with this.
---
### Author:  [@tarek](https://meta.discourse.org/u/tarek)
#### Post date: [May 5, 2016, 9:11pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/13 "2016-05-05T21:11:00Z")
I really have no idea how to debug RoR either. I’m trying now to figure that out.. Currently, that looks like where I’m stuck.
I also am having no luck trying to manually get the data out with a REST client.. What do you use to test?
tarek : )
---
### Author:  [@dashohoxha](https://meta.discourse.org/u/dashohoxha)
#### Post date: [May 5, 2016, 9:18pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/14 "2016-05-05T21:18:24Z")
> [@tarek](#):
>
> What do you use to test?
For testing I use this: [http://info.btranslator.org/api-examples-js/](http://info.btranslator.org/api-examples-js/)
See the section OAuth2/user/profile (on the left). Then check the javascript code and the output.
---
### Author:  [@dashohoxha](https://meta.discourse.org/u/dashohoxha)
#### Post date: [May 5, 2016, 11:58pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/15 "2016-05-05T23:58:35Z")
I have extended the Drupal module to accept both **POST /oauth2/user/profile** and **GET /oauth2/user\_profile** (see the description at [Client Challenge](https://www.drupal.org/project/oauth2_loginprovider)).
---
### Author:  [@tarek](https://meta.discourse.org/u/tarek)
#### Post date: [May 5, 2016, 11:59pm UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/16 "2016-05-05T23:59:50Z")
WOW WOW WOW!!! That’s so wonderful!
Thank you so much!! Now I’m just trying to figure out where each path is, and then I’ll update above.
tarek : )
---
### Author:  [@tarek](https://meta.discourse.org/u/tarek)
#### Post date: [May 6, 2016, 12:49am UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/17 "2016-05-06T00:49:08Z")
I have updated the first post with the new error. In essence, Drupal is NOT giving json, but IS giving XML. Here is the output:
```plaintext
757: unexpected token at '
555testusertestuser@testuser.org1273090146526314624938921230picture-555-profile.pngpublic://pictures/picture-picture-555-profile.pngimage/png206962114164658https://DRUPAL/sites/DRUPAL/files/pictures/picture-555-profile.pngt
```
We are way closer now!! Thank you!
tarek : )
---
### Author:  [@tarek](https://meta.discourse.org/u/tarek)
#### Post date: [May 6, 2016, 1:21am UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/18 "2016-05-06T01:21:29Z")
GOT IT!!!
just needed a .json at the end!
Will update above!
tarek : )
---
### Author:  [@dashohoxha](https://meta.discourse.org/u/dashohoxha)
#### Post date: [May 6, 2016, 5:58am UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/19 "2016-05-06T05:58:29Z")
> [@tarek](#):
>
> Drupal is NOT giving json, but IS giving XML
This is related to the configuration of the Drupal module **Service** s at **/admin/structure/services/list/oauth2\_login\_provider/server** By default all types of request and response formats are enabled, and if the HTTP request does not specify a response format, XML is used by default. Either you can restrict this on the server, or make the client specify that they want JSON. In one of my JavaScript example I do it like this: [B-Translator.github.io/api-examples-js/examples/oauth2/get\_user\_profile.js at master · B-Translator/B-Translator.github.io · GitHub](https://github.com/B-Translator/B-Translator.github.io/blob/master/api-examples-js/examples/oauth2/get_user_profile.js#L10)
Apparently it also works if you append the extension .json to the URL (you discovered this). As long as it works, it is fine.
---
### Author:  [@tarek](https://meta.discourse.org/u/tarek)
#### Post date: [May 6, 2016, 6:03am UTC](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652/20 "2016-05-06T06:03:02Z")
> [@dashohoxha](#):
>
> In one of my JavaScript example I do it like this: [B-Translator.github.io/api-examples-js/examples/oauth2/get\_user\_profile.js at master · B-Translator/B-Translator.github.io · GitHub](https://github.com/B-Translator/B-Translator.github.io/blob/master/api-examples-js/examples/oauth2/get_user_profile.js#L10)
I tried this and could not get it to work, neither in my own REST client, nor in your b-translator, as dataType will always default to json (I tried ‘xml’, for example).
Regardless, mercifully this is behind me! I also got my Kunena posts redirected, which is also merciful. So no problems!
tarek : )
[Next page](https://meta.discourse.org/t/oauth2-integration-with-drupal/43652.md?page=2)