Answers.Body: <p>The <a href="https://github.com/pixelandtonic/Craft-Release/blob/master/app/services/UserSessionService.php#L572" rel="nofollow">onBeforeLogin event</a> is fired after the username/password is already authenticated, but before the actual authenticated session is started, which is why you're seeing the behavior you're seeing.</p>
  
  <p>For the same reason that you wouldn't expect the <code>onBeforeSaveEntry</code> event to be fired before entry validation has occurred.</p>
  
  <p>I believe to pull off what you're looking for, we'd need to add a new event... something like <code>onBeforeAuthenticateUser</code>.</p>
  
  <p>Probably worth adding as a <a href="https://feedback.craftcms.com" rel="nofollow">feature request</a>.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-10-28T21:09:23.540Z
Answers.LastActivityDate: 2016-10-28T21:09:23.540Z
Answers.UserDisplayName: Brad Bell
Body: <p>I'm trying to take advantage of the <code>userSession.onBeforeLogin</code> event to interrupt the normal Control Panel login (/admin/login) so that I can first authenticate the user against an LDAP server. However, in my testing it seems that Craft runs its own authentication prior to <code>onBeforeLogin</code> event.</p>
  
  <pre><code>class AdminAuthPlugin extends BasePlugin
  {
      public function init()
      {
          parent::init();
  
          craft()-&gt;on('userSession.BeforeLogin', function (Event $event) {
              if (craft()-&gt;request-&gt;isCpRequest() == true) {
                  $event-&gt;performAction = false;
                  exit();
              }
          });
      }
  }
  </code></pre>
  
  <p>Using the above example, attempting to log in with a known username (with correct password) who has access to the CP, <code>UserSessionService</code> throws an error--which I expect to see due to the <code>exit()</code>: "An unknown error occurred." However, if I try to log in with the same username and an invalid password, <code>UserSessionService</code> throws the standard error, "Invalid username or password", which indicates that <code>onBeforeLogin</code> has not been executed.</p>
  
  <p>Am I correct to understand that the <code>userSession.onBeforeLogin</code> event indeed fires after the default authentication attempt?</p>
  
Tags: <plugin-development><users>
Title: Does normal authentication occur before userSession.onBeforeLogin event?
ThreadText: # Does normal authentication occur before userSession.onBeforeLogin event?
  
  (Asked by: username_0 on 2016-10-28)
  
  I'm trying to take advantage of the `userSession.onBeforeLogin` event to interrupt the normal Control Panel login (/admin/login) so that I can first authenticate the user against an LDAP server. However, in my testing it seems that Craft runs its own authentication prior to `onBeforeLogin` event.
  
  ```
  class AdminAuthPlugin extends BasePlugin
  {
      public function init()
      {
          parent::init();
  
          craft()->on('userSession.BeforeLogin', function (Event $event) {
              if (craft()->request->isCpRequest() == true) {
                  $event->performAction = false;
                  exit();
              }
          });
      }
  }
  
  ```
  
  Using the above example, attempting to log in with a known username (with correct password) who has access to the CP, `UserSessionService` throws an error--which I expect to see due to the `exit()`: "An unknown error occurred." However, if I try to log in with the same username and an invalid password, `UserSessionService` throws the standard error, "Invalid username or password", which indicates that `onBeforeLogin` has not been executed.
  
  Am I correct to understand that the `userSession.onBeforeLogin` event indeed fires after the default authentication attempt?
  
  **Tags:** plugin-development, users
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2016-10-28. Score: 3 | Accepted answer
  
  The [onBeforeLogin event](https://github.com/pixelandtonic/Craft-Release/blob/master/app/services/UserSessionService.php#L572) is fired after the username/password is already authenticated, but before the actual authenticated session is started, which is why you're seeing the behavior you're seeing.
  
  For the same reason that you wouldn't expect the `onBeforeSaveEntry` event to be fired before entry validation has occurred.
  
  I believe to pull off what you're looking for, we'd need to add a new event... something like `onBeforeAuthenticateUser`.
  
  Probably worth adding as a [feature request](https://feedback.craftcms.com).
  
  
  ---
  
  