Simple Phorum/Website Login
Posted by bwrobo
|
August 13, 2011 07:49AM |
You are using terms like 'simple' and 'easy' for a problem that knows many forms and is mostly not simple at all. Sure, the whole concept seems simple, but authentication integration requires linking two random systems, where each system can be using some completely different approach to authentication and session management.
What you didn't talk about, is what your main site's authentication looks like. Is it using authentication at all? So is Phorum a slave application that should following your main site's authentication?
One thing to take care of, is that you create a Phorum user for each main site user. It is the main requirement for making it possible to integrate Phorum. This can be done at various places in the system. You could integrate it with your own user management, so creating / changing / deleting users is directly propagated to Phorum. Another way would be to handle the user syncing is doing it on-the-fly from a Phorum module.
The most standardized and solid method for handling authentication integration, is writing a module that makes use of the user_session_restore hook. From that hook you could take care of syncing your authenticated user to the Phorum system. It is also the hook where you could pick up a user session from your system. It's the place where you can tell Phorum "User X is logged in".
This kind of integration does not require storing the username and password in the session. You would only need to know how your main site keeps track of a logged in user and replicate that in the user_session_restore hook.
If you keep tracking the goal of passing username and password to Phorum (at least make sure that you only store them when they are correctly entered by the user), then you would also have to write a Phorum module to pick up this info. And you would also have to create the user in Phorum with this username and password to make it possible to end up with an authenticated Phorum user. This route of checking the user+pass in the session might sound simple, but consider that you would also have to take care of noticing that a user logged out or (even more important) that another user is logged in. Phorum will keep track of the logged in user in its own session, independent from your main site's session.
When using the user_session_restore logic, then there's less of this bookkeeping going on. The hook will decide on every page request whether or not a user is logged in. As soon as your main site's user logs out or changes, Phorum will recognize this immediately.
I'm not sure how much of a programmer you are. By now, I hope you see that we're definitely not talking "simple" here and that one way or the other, coding is required for getting this to work.
Searching for "user_session_restore" on these forums will bring up some more info on this. You could also take a look at the external authentication module, which is built around this hook.
Maurice Makaay
Phorum Development Team
my blog 
linkedin profile 
secret sauce
What you didn't talk about, is what your main site's authentication looks like. Is it using authentication at all? So is Phorum a slave application that should following your main site's authentication?
One thing to take care of, is that you create a Phorum user for each main site user. It is the main requirement for making it possible to integrate Phorum. This can be done at various places in the system. You could integrate it with your own user management, so creating / changing / deleting users is directly propagated to Phorum. Another way would be to handle the user syncing is doing it on-the-fly from a Phorum module.
The most standardized and solid method for handling authentication integration, is writing a module that makes use of the user_session_restore hook. From that hook you could take care of syncing your authenticated user to the Phorum system. It is also the hook where you could pick up a user session from your system. It's the place where you can tell Phorum "User X is logged in".
This kind of integration does not require storing the username and password in the session. You would only need to know how your main site keeps track of a logged in user and replicate that in the user_session_restore hook.
If you keep tracking the goal of passing username and password to Phorum (at least make sure that you only store them when they are correctly entered by the user), then you would also have to write a Phorum module to pick up this info. And you would also have to create the user in Phorum with this username and password to make it possible to end up with an authenticated Phorum user. This route of checking the user+pass in the session might sound simple, but consider that you would also have to take care of noticing that a user logged out or (even more important) that another user is logged in. Phorum will keep track of the logged in user in its own session, independent from your main site's session.
When using the user_session_restore logic, then there's less of this bookkeeping going on. The hook will decide on every page request whether or not a user is logged in. As soon as your main site's user logs out or changes, Phorum will recognize this immediately.
I'm not sure how much of a programmer you are. By now, I hope you see that we're definitely not talking "simple" here and that one way or the other, coding is required for getting this to work.
Searching for "user_session_restore" on these forums will bring up some more info on this. You could also take a look at the external authentication module, which is built around this hook.
Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce
Sorry, only registered users may post in this forum.