Login Integration
Posted by tlshaheen
|
Re: Login Integration May 11, 2010 06:05PM |
There is no need to set a cookie when using user_session_restore(). The thing is that Phorum will normally try to restore a session by checking its cookie. But user_session_restore() can be used to intercept that process and to tell Phorum what user is logged in at the moment. Therefore, a Phorum cookie is not needed here. Only a cookie or whatever session mechanism you use in the authentication master application.
Looking at this code, it would fit in the user_session_restore hook, like:
Assumption here is that the user id from your master system ($master_id) is equal to the user_id of the Phorum users that you created. If not, then you would have to implement some mapping between master app user ids and Phorum user ids (which the external auth module does too).
Maurice Makaay
Phorum Development Team
my blog 
linkedin profile 
secret sauce
Looking at this code, it would fit in the user_session_restore hook, like:
function your_user_session_restore_module_function($sessions);
{
$master_id = your_master_app_auth_id_get();
if ($master_id) {
$sessions[PHORUM_SESSION_SHORT_TERM] = $master_id;
$sessions[PHORUM_SESSION_LONG_TERM] = $master_id;
}
return $sessions; // <-- so here you pass the sessions to Phorum
}
Assumption here is that the user id from your master system ($master_id) is equal to the user_id of the Phorum users that you created. If not, then you would have to implement some mapping between master app user ids and Phorum user ids (which the external auth module does too).
Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce
|
Re: Login Integration May 12, 2010 02:32AM |
You're doing things up-side-down here. It's true that a lot of systems will force you into this kind of coding for integrating authentication. The login / session code from the main application then has to set a cookie for the bridged application to recognize the user.
That method is considered seriously flawed by the Phorum team. There is no tight coupling at all between the session from the main application and the session from the bridged application (Phorum in this case).
In Phorum we provide functionality by means of the "user_session_restore" hook to make it possible through a module to let Phorum investigate the session of the master application. BTW: this is done at the start of every request (just like the main app would do). If the module finds an active session there, it can set the user_id to use for the Phorum session. Look ma, no cookie!
The big advantage here is that you do not have to hack the main application code and that the moment that the main application session ends, Phorum will follow in its footsteps.
Based on your code, an example module for specifically this job might look like this:
[code=php]
<?php
/* phorum module info
hook: user_session_restore|phorum_mod_your_user_session_restore
title: Inherit session from my application
desc: This module will inherit the user_id session from the main application.
*/
function phorum_mod_your_user_session_restore($sessions)
{
// Phorum does not start a session, so we have to start it
// here to be able to access the main application's $_SESSION data.
// The session_id() is checked to not to call session_start() twice.
if (!session_id()) session_start();
// If the user is logged into the main session, then tell Phorum
// to use the user_id from the session.
if (!empty($_SESSION['user_id'])) {
$sessions[PHORUM_SESSION_SHORT_TERM] = $_SESSION['user_id'];
$sessions[PHORUM_SESSION_LONG_TERM] = $_SESSION['user_id'];
}
return $sessions;
}
?>
[/code]
The only part that has to be taken care of in addition, is creating the user with the same user_id in Phorum using phorum_api_user_save(). After the user is created, the above module should work (untested, but I hope the idea is clear).
If you are not synchronizing the user_ids, then the hook code from above could for example lookup the Phorum user_id by searching for $_SESSION['username']. However, the user_id method would be best performance-wise, since it would not require an additional SQL query to lookup the Phorum user_id.
Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce
That method is considered seriously flawed by the Phorum team. There is no tight coupling at all between the session from the main application and the session from the bridged application (Phorum in this case).
In Phorum we provide functionality by means of the "user_session_restore" hook to make it possible through a module to let Phorum investigate the session of the master application. BTW: this is done at the start of every request (just like the main app would do). If the module finds an active session there, it can set the user_id to use for the Phorum session. Look ma, no cookie!
The big advantage here is that you do not have to hack the main application code and that the moment that the main application session ends, Phorum will follow in its footsteps.
Based on your code, an example module for specifically this job might look like this:
[code=php]
<?php
/* phorum module info
hook: user_session_restore|phorum_mod_your_user_session_restore
title: Inherit session from my application
desc: This module will inherit the user_id session from the main application.
*/
function phorum_mod_your_user_session_restore($sessions)
{
// Phorum does not start a session, so we have to start it
// here to be able to access the main application's $_SESSION data.
// The session_id() is checked to not to call session_start() twice.
if (!session_id()) session_start();
// If the user is logged into the main session, then tell Phorum
// to use the user_id from the session.
if (!empty($_SESSION['user_id'])) {
$sessions[PHORUM_SESSION_SHORT_TERM] = $_SESSION['user_id'];
$sessions[PHORUM_SESSION_LONG_TERM] = $_SESSION['user_id'];
}
return $sessions;
}
?>
[/code]
The only part that has to be taken care of in addition, is creating the user with the same user_id in Phorum using phorum_api_user_save(). After the user is created, the above module should work (untested, but I hope the idea is clear).
If you are not synchronizing the user_ids, then the hook code from above could for example lookup the Phorum user_id by searching for $_SESSION['username']. However, the user_id method would be best performance-wise, since it would not require an additional SQL query to lookup the Phorum user_id.
Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce
Sorry, only registered users may post in this forum.