Single Sign On in Moodle with external login form

Question

I'm developing a moodle site where I have to use an external service for authenticating users. This SSO service should be the only form of authentication.

The provider of the external service requires me to do use their login form on their server so I have to disable the moodle login form.

I have looked at the various authentication plugins but none of them seems to do exactly what I need them to do.

Thus far I think this is what I'm going to do:

1. Change the login/index.php file so it does nothing but redirect the user to the external login form.
2. The SSO service heads back to a new page on my Moodle server that confirms the credentials supplied.
3. All relevant user data is collected from a SOAP webservice connected to the SSO service.
4. If the (unique) username provided by the SSO service exists in the mdl_users table the row is updated with the relevant user data.
5. If the username does not exist a new user is generated automatically The user is then logged in to the Moodle site and headed to their front page.

This is my first time working with Moodle so I have a few questions:

1. How can I create a new user automatically? Is it enough just to add a new entry to mdl_users?
2. How do I sign a user in?
3. Can I make this sort of functionality as an authentication plugin or do I need to make a hack in the login/index.php file?
4. How do I disable the no longer needed parts of Moodle's own user management (i.e. password reset, user info fields that are collected from the SOAP service etc.)?

I really hope you can help me :)

Answer 1

1. Call create_user_record() (line 4008 of lib/moodlelib.php in master branch). This does the insert into mdl_user but also performs a bunch of checks and calls other functions to take care of dependencies, event triggers and so on. This function is called automatically by authenticate_user_login() (see below) if the user being authenticated doesn't already exist.
2. This involves calling authenticate_user_login() (line 4378 of lib/moodlelib.php) followed by complete_user_login() (line 4577 of lib/moodlelib.php).
3. This can all be achieved by creating an authentication plugin, and you should be able to find everything you need to know at https://docs.moodle.org/dev/Authentication_plugins, including links to example code and a suggested template.
4. You can lock user profile fields via your auth plugin and you can actually set a custom/external password reset page via the admin interface at /admin/settings.php?section=manageauths.

Hope this helps.