Phorum and custom login

Hi,

I am trying to integrate Phorum into one of my sites. I have successfully customized the look and feel and everything works. Since my site has its own authentication system for logging users in I would like to bypass logging into Phorum for a user that has successfully logged into the website.

I have tried to follow some of the threads and have endeavored to trace some of the Phorum code. Even though the data exists (in the Phorum Users table) and is in sync with my Users table, Phorum does not acknowledge the fact that the user exists. I am using code (function custom_phorum_user_login($userid,$username1,$pwd) ) from "userinterface.php" which can be found under the "Using your own Authentication System" topic. I am trying this locally on my computer running A(pache)M(ySQL)P(HP) on W(indows). I suspect the problem could be the cookies or sessions but am not sure.

Is this the best way to bypass the login? Is there an easier or more basic way? Can someone tell me what Phorum uses to "know" a user has/n't logged in? Although I am fairly knowledgeable in PHP, I am not familiar with the concept of modules and plug-ins within Phorum. I chose Phorum after evaluating a lot of other forum softwares and really like it but attempting to integrate this part is causing no end in frustration. I think I am close but just need a little help.

Now that you know the background, can one of you please assist me in creating a simple login bypass if my user has successfully logged into my website? I have read the threads on keeping the user table in Phorum in sync etc. I don't have any problems with that. I thank you in advance for all your assistance.

Elvin

You can check out what I have done in my embed phorum module. Even as a Phorum developer I'm not 100% sure if what I did was the easiest way to pass on authentication from my master system to Phorum, but I can tell you that the method does work.

---

Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce

Line from cookie:

phorum_session_v5=1207%3Aa72adbc880d626ca5c42a701d8f1fe40

1207 is user number
%3A - spacer

phorum_users table
field: cookie_sessid_lt
a72adbc880d626ca5c42a701d8f1fe40

Hi guys, thanks for trying to assist me with this.

Maurice: You are right. Although your approach may be clinically sound I don't have the time to learn it deep (especially with mods and hooks) so will have to pass it. I know eventually I will go down your path but time doesn't favor it yet. But I do value your advice and thoughts on Phorum internals so hope you will participate in this thread.

DavidVB: I think you know the problem I am having. I feel the Phorum_session may not be getting created. Is this an IE/Localhost issue? I would think not but don't know for sure. Should I test in Netscape? Or FF? Tracing through all the calls I know the data (userid) is being found. It's just the final step(s) that may cause it to fail.

Thanks once again for your help.

Elvin

Do you set the temporary cookie too?

And you should use FF (or any other modern browser) instead of IE in any case :-)

It's so much easier to see what a cookie has eaten for example not to mention everything else that is much better in any other browser...

---
-=[ Panu ]=-

To troubleshoot this I would go into the phorum_users table and either record or reset the cookie_sessid_lt field to 0 for your test user. Then go in and try to log on. If this field has been changed, it means that you have gotten phorum to be logged on and the problem is with the cookie.

Then you should look and see what (if any) cookies are created. I would be careful to see if there was a www.yoursite.com cookie created and also a yoursite.com cookie (you might also end up with a localhost cookie). This could be fixed by changing the phorum base url in admin. Then check what info is in the cookie.

Another way to see what is happening in your session is to run the phpinfo() command when you are logged in (you might have to put this command in a short program file). This will show what cookie information is being passed back to your server.



Edited 1 time(s). Last edit at 07/20/2006 11:17AM by DavidVB.

Panu: I am following David's advice to double-check on these items. On the browser, I certainly agree with your points. However, I'm nervous that things may work on other browsers but not on IE (in which case I will eventually have to deal with it). However, I will take your (and other members') advice and switch to a (ahem!) different browser.

David: Excellent advice and direction. I will certainly try these steps and provide feedback. Question: I am running all of these tests on my local machine. So of course my URL starts with "localhost". Off memory I think my base URL is also localhost. Is this correct? I believe the login code to the site (I inherited the code) also creates a cookie but with the domain (www.sitedomain.com) and this (it appears) is hard-coded. Are these things interfering with Phorum's ability to create the right cookie? Would love to hear your comments. I think we are on the right path here.

Thanks a bunch.

There is a hostname set up in the apache configuration file. There is also one in the phorum session_domain field in the main phorum file. If your main software sets the cookies by using a hard coded host name, there are likely to be problems with the cookie file(s). (for testing purposes, you might have to change the hard coded one to localhost to get a fully functional cookie file. - in production you would restore the hard code in your login program, change the configuration file on the production server and change the field in phorum administration.) If you end up with a name@localhost and name@www.sitedomain.com cookies, it will indicate that the cookie is not properly getting generated.

phpinfo() will tell you what cookie information is being passed to the server. MS has figured out how to send a cookie to a server so your testing environment shouldn't matter all that much. The data on the cookie is manipulated by the server and the clients don't change the information.

OK. I tried as David suggested and noticed a few things (which have lead to more questions unfortunately).

I reset the cookie_sessid_lt field (to 0) and ran through my script(s). It does get set so it looks like Phorum is acknowledging the user and validating correctly. (Never doubted that). However, I do not see any cookie being created.

But when I log in as an Admin, it does show the following (in Netscape)
Site Cookie Name
localhost phorum_admin_session
The content of the cookie seems to be 1%3Ae4f80ba8f45acc8761899f9701a1bdd4 with a path of "/" that expires at the end of the session.

From this I can deduce that Phorum is capable of creating cookies on my localhost. However, it isn't doing so when I run it through the script. So I think I have narrowed it down to the cookie with your help. I have removed any restriction within the browser to see if it will help.

The other strange anomaly I have found is that I cannot login again as an Administrator. It keeps coming back refreshing the login page with blanks. I haven't checked the login code to see why it does that but feel Phorum is trying to validate via multiple fields in the users table. Does anyone have more information on this? Currently, I have had to recreate the tables (twice) and start from scratch again. This is, however, a smaller issue compared to the cookie. Does anyone have any ideas on what I must be doing wrong. Perhaps it's an incorrect setting? Any suggestions are welcome.

Thanks!

maybe [www.phorum.org] is related? Or did you check all path already?

And you don't have to recreate the tables you can only delete the records

---
-=[ Panu ]=-