Jelix PHP Framework and Phorum Integration

Hi,

I'm using Jelix with a dedicated module name jCommunity that deals with the authentication process.

So to be able to be auth'ed on the portal and on "phorum" i use this piece of code extracted from the examples api :
[code="php"]
$curpwd = dirname(__FILE__);
chdir(dirname(__FILE__)."/../../../www/forum/");
define('phorum_page','jelix');
require_once "common.php";

class phorumauth {

function jelix_user_session_restore($data) {

$user_id = phorum_api_user_authenticate(
PHORUM_FORUM_SESSION, // for a standard front end forum session
$data['login'], // the username to check
$data['password'] // the password to check
);
if (!$user_id) die("Username or password incorrect!\n");

$set_active = phorum_api_user_set_active_user(
PHORUM_FORUM_SESSION, // for a standard front end forum session
$user_id, // the user_id that has to be the active user
PHORUM_FLAG_SESSION_ST // jumpstart the short term session
);

if (!$set_active) die("Setting user_id $user_id as the active user failed!\n");

// Create a session for the active user, so the user will be remembered
// on subsequent requests.
phorum_api_user_session_create(
PHORUM_FORUM_SESSION, // for a standard front end forum session
PHORUM_SESSID_RESET_LOGIN // reset session ids for which that is
); // appropriate at login time

}


}
chdir($curpwd);
[/code]

My Question is :
Is there a lighter way to authenticate on phorum or do I have to proceed like this ?

Kind Regards.

[www.foxmask.info]

[www.phorum.org]

edit mmakaay: that thread gets interesting from this message on. The start of that thread is not about user_session_restore


Also search on "user_session_restore " will give lots of info.



Edited 1 time(s). Last edit at 10/01/2008 06:51AM by Maurice Makaay.

The best solution for authentication inheritance in Phorum, is to use the "user_session_restore" hook in a Phorum module instead of pushing the authentication from an external system towards Phorum. In that hook, you can let Phorum collect the authenticated user from the Jelix system. If an authenticated user is found, then it can be related to a Phorum user (you always have to create a Phorum user from your code or on-the-fly from this hook's code) and the user_id of the Phorum user that has to be logged in can be returned by the module.

One of the big advantages is that this will follow the authentication from Jelix immediately. If a user logs in, then Phorum sees that user logged in too. If a user logs out, then automatically the Phorum user is logged out as well. There's no need to juggle cookies from outside Phorum. Phorum would actually not need a session cookie anymore in this setup, because the session is not restored based on a cookie, yet based on the actual authentication state in Jelix.

For some examples, search these boards for "user_session_restore". Some small example hook implementations were posted, so they might be useful for inspiration.

Also check out the user_session_restore docs under DOCS -> Developer Manual -> Module hooks.

---

Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce

Hi Maurice,

Thank you for your answer.

I've already read a lot of threads (where you answered always the same thing with a great patient ;) and gone throw the doc to understand "hook".
I've well understand the benefits of using user_session_restore hook
BUT :
1) if I really want to push the authentication to phorum, is this the lighter way to proceed ?
( I think yes or you never provide this example in the delivery :)
currently, like I already wrote the things at the beginning of the thread, that's working (for the log in, not yet for the log out)

Quote
Maurice Makaay
One of the big advantages is that this will follow the authentication from Jelix immediately. If a user logs in, then Phorum sees that user logged in too

i don't see from where the users log in ? from Phorum of from Jelix ?
if it's from Jelix, how do i have to make the call of the hook from outside of Phorum ?


2) if I follow your recommendations and i drop this class from Jelix :
2.a) how do i deal with the Jelix Auth system with the hook ?
2.b) do i have to use something like include/api/examples/user_auth_module.php ?
2.c) where are stored the custom hooks in the Phorum directory tree ?

in advance i'm sorry if my questions are stupid ; i'm not yet familiar with Phorum :)

Kind Regards.

[www.foxmask.info]

Quote
foxmask
1) if I really want to push the authentication to phorum, is this the lighter way to proceed ?
( I think yes or you never provide this example in the delivery :)
currently, like I already wrote the things at the beginning of the thread, that's working (for the log in, not yet for the log out)

If you really want to push the authentication, then this is a good way to handle it. It uses all API code, so internal changes would not break it and this only has to be called once, so I wouldn't worry about doing things more lighter (if it's lighter as in resources that you are targetting at).

[uquote=foxmask]i don't see from where the users log in ? from Phorum of from Jelix ?
if it's from Jelix, how do i have to make the call of the hook from outside of Phorum ?[/quote]

You simply don't.

• Your user logs into Jelix
• Jelix sets up some session management for Jelix
• Your user clicks to the Phorum pages
• Phorum runs its authentication code to see who's knocking the door
• Phorum gets to the point where it tries to pick up an already existing user session
• During this action, the user_session_restore hook is called
• Your module's user_session_restore function checks against the Jelix session management to see who is logged in. If it finds a logged in user, it maps this user to a Phorum user and puts the user_id in the hook's return data
• The Phorum user session code picks up this user_id and will run Phorum as the provided user_id

It might be hard to grasp at first, but the thing to see is that Phorum initiates the hook and your module will only at that point check with Jelix if a session is available or not. If you do not override the session restore code, then Phorum would check to see if there is a Phorum cookie to base a session upon, but that is not needed in this case.

Once your user logs out in Jelix, the orange colored step from above will find that no session is available and can return FALSE as the user_id. That will flag Phorum that no user is logged in at the moment.

Quote

2) if I follow your recommendations and i drop this class from Jelix :
2.a) how do i deal with the Jelix Auth system with the hook ?

That depends on the implementation of the Jelix Auth system. In my own setup, where I authenticate against my own user system, I have a standard PHP session variable that holds the data for the authenticated user. In the authentication module's user_session_restore function, I only have to look at $_SESSION['user'] to see who is logged into my main user system. Some other systems might have an API to retrieve the authenticated user. Maybe include some PHP file and call some $coolsystem->get_user() method to retrieve the authenticated user. What way you need depends on Jelix. But the important thing is that you'd need the code that is able to determine the authenticated Jelix user from your module.

Quote

2.b) do i have to use something like include/api/examples/user_auth_module.php ?

No, that example contains way too much info. You only need to implement user_session_restore().

You could implement user_session_create and user_session_destroy as well as an extra, to fully disable Phorum's own session cookie code (implement the functions and simply let them return NULL IIRC), but functionally there is no need to do so.

Quote

2.c) where are stored the custom hooks in the Phorum directory tree ?

What are custom hooks? Do you mean to ask how you could implement such hook? Take a look at the developer documentation about writing modules. Some extra info might be available in docs/creating_modules.txt in your package, because not all has been transferred to the docbook yet.

Quote

in advance i'm sorry if my questions are stupid ; i'm not yet familiar with Phorum :)

Well, get on with it then!!! ;-)

Get used to the very cool user_session_restore functionality. I know about every other system out there uses cookie-pushing to handle integration, but we don't like the kind of loose user coupling that is implemented by that method. The module solution is both simple (once you get the hang of it ;-) and rock-solid.

---

Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce

Thank you for the long and complete answer.

So if i've well understood :

Jelix does its job in its corner, and the Phorum hook, checks the existing Jelix session, when a user access to the forum.

And at least : if a user log out, throw the hook I have to close the Jelix session too.


Kind Regards.

[www.foxmask.info]

Quote
foxmask
And at least : if a user log out, throw the hook I have to close the Jelix session too.

Unable to translate error...
If there was a question in here, then please rephrase.

And yes, it sounds like you got the hang of it now.
Welcome and join the happy integration people club ;-)

---

Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce

Quote
Maurice Makaay

Quote
foxmask
And at least : if a user log out, throw the hook I have to close the Jelix session too.

Unable to translate error...

lol ok :D

Quote
Maurice Makaay
And yes, it sounds like you got the hang of it now.

to make a shortcut ; yes that's it ;)

Quote
Maurice Makaay
Welcome and join the happy integration people club ;-)

thanks :D

[www.foxmask.info]