Single Signin / Login Integration Tip

[Kalyse]

Originally Posted by hornstar1337

This has been out since last year already https://vborg.vbsupport.ru/showthrea...n+non+vb+pages

I think that would have solved your solution/s already

Thats not what he is doing.
He has a site first, then Vb.

Not theother way round.
That link doesn help at all.

[dionak]

Just curious, what perl script?

Originally Posted by wcm

Has anyone tried the Perl solution with 3.6? It looks like a very neat way to do this.

I am a little bit curious on how the final perl script looks.

This is really validating. I used a similar approach in a recent site. It's cgi-perl as opposed to mod_perl, mostly b/c when I started to build...I didn't know if I would have mod_perl on the destination server.

Orbita, I really like your approach. It's really clean (and would reduce my code a lot!).

I recently did a single sign-on for a site which included the site, vbulletin and mediawiki. Mediawiki uses PHP sessions, as opposed to cookies. I'm still puzzling how to tell if the user is logged into the site, vbulletin and mediawiki without checking every request (which I'm not doing, it would be extreme overhead).

I guess since the scenario described in your post only involves cookies, it's easy to set them all to expire at the same time so you don't have the session vs. cookie expiry synch issue I'm experienceing. Any ideas on that?

I had a lot of issue with the sessions in the VB integration which is why I chose the same method of using LWP::UserAgent to post to the registration and login scripts in VB.

To do registration, I created a form and corresponding script that processes the form and posts to the registration scripts for vbulletin and mediawiki using LWP::UserAgent. Same as login. It's a challenge though, because 3.6.4 changed the registration logic slightly and now I need to figure out how to accomodate the new logic. It looks like VB registration is now looking for a MD5 hash in the post to register.

Upon registration, the last bit of my custom code creates what I'm calling an 'application username' and 'application password'. The values are whatever the user registers with. These are used for the login, no matter how many times the user might change their password.

So when a user registers, their password is hashed into the 'password' and 'app_password' columns in my custom users table. When the user logs in, I check the submitted password against the 'password' column, then the 'app_password' is retrieved and used for the login request.

To handle the user profile information in vbulletin, I created a plugin that redirects the user to the site account page if they try to update their username or password. Updating both my app's users table and the vb_users table seemed both troublesome and a lot of work for this critical component.

Mediawiki turned out to be a lot easier once I wrapped my head around it. It has 'hooks', so I was able to write an Authentication plugin (called Authplugin in MW) that was a lot simplier. I set up a php script to read my site cookie and set a variable. If the variable is empty (the user isn't logged in) it authenticates the user using the site cookie.

It would be a heck of a lot easier to integrate Vbulletin if it had an authentication hook like this. Or maybe there is a way to do it that I haven't yet realized? There is the global_start for plugins.

Diona

[apn3a]

does anyone have any idea how to integrate a login system of a different php script with vbulletin? meaning that users who login to the other script, can login to vbulletin too without having to re-register to vbulletin.

thanks

[byon]

Originally Posted by apn3a

does anyone have any idea how to integrate a login system of a different php script with vbulletin? meaning that users who login to the other script, can login to vbulletin too without having to re-register to vbulletin.

thanks

these are the stuffs u need.

login.php

PHP Code:

$includes = Array(
        'config.php');
foreach($includes as $include)
        require_once($include);
require_once(DIR . '/includes/functions_login.php');


// redirect if user is logged-on
if (!empty($vbulletin->userinfo['userid'])) {
        header('Location: ' . CTRLER);
}

if ($_POST['do'] == 'login') {
        $redirectLoginSuccess = "http://byon/~john/store/main.php";
        $vbulletin->input->clean_array_gpc('p', array(
                'username'        => TYPE_STR,
                'password'        => TYPE_STR,
                'md5password'     => TYPE_STR,
                'md5password_utf' => TYPE_STR,
                'postvars'                 => TYPE_STR,
                'cookieuser'               => TYPE_BOOL,
                'logintype'                => TYPE_STR,
                'cssprefs'                 => TYPE_STR,
        ));


        // can the user login?
        $strikes = verify_strike_status($vbulletin->GPC['username']);

        if ($vbulletin->GPC['username'] == '')
        {
                eval(standard_error(fetch_error('badlogin', $vbulletin->options['bburl'], $vbulletin->session->vars['sessionurl'], $strikes)));
        }

        // make sure our user info stays as whoever we were (for example, we might be logged in via cookies already)
        $original_userinfo = $vbulletin->userinfo;

        if (!verify_authentication($vbulletin->GPC['username'], $vbulletin->GPC['password'], $vbulletin->GPC['md5password'], $vbulletin->GPC['md5password_utf'], $vbulletin->GPC['cookieuser'], true))
        {
                ($hook = vBulletinHook::fetch_hook('login_failure')) ? eval($hook) : false;

                // check password
                exec_strike_user($vbulletin->userinfo['username']);

                if ($vbulletin->GPC['logintype'] === 'cplogin' OR $vbulletin->GPC['logintype'] === 'modcplogin')
                {
                        // log this error if attempting to access the control panel
                        require_once(DIR . '/includes/functions_log_error.php');
                        log_vbulletin_error($vbulletin->GPC['username'], 'security');
                }
                $vbulletin->userinfo = $original_userinfo;

                if ($vbulletin->options['usestrikesystem'])
                {
                        eval(standard_error(fetch_error('badlogin_strikes', $vbulletin->options['bburl'], $vbulletin->session->vars['sessionurl'], $strikes)));
                }
                else
                {
                        eval(standard_error(fetch_error('badlogin', $vbulletin->options['bburl'], $vbulletin->session->vars['sessionurl'])));
                }
        }

        exec_unstrike_user($vbulletin->GPC['username']);

        // create new session
        process_new_login($vbulletin->GPC['logintype'], $vbulletin->GPC['cookieuser'], $vbulletin->GPC['cssprefs']);
        // do redirect
        do_login_redirect();
}
?>

<!--
here lies the input boxes (username,password)
--> 


config.php

PHP Code:

define('THIS_SCRIPT', 'storeconfig');
chdir("../vbb/");
include("./includes/config.php");
include("./global.php"); 


Regards,
John Goh

[xRenegade85]

i was trying to do this to login:
http://mysite.com/login.php?vb_login..._password=blah
but this doesnt do anything, anyone know why?

[version2]

Originally Posted by xRenegade85

i was trying to do this to login:
http://mysite.com/login.php?vb_login..._password=blah
but this doesnt do anything, anyone know why?

You are going to pass your passwords in the URL? That's not a good idea.

[nizu]

i search for it for a very long time! thanks orbita!

now....did anyone try it on vbulletin 3.7?

[Submerge]

Originally Posted by nizu

i search for it for a very long time! thanks orbita!

now....did anyone try it on vbulletin 3.7?

I'll try it, anyone know of any other articles explaining this technique?

[edit] Nvm, I'm not using two separate user databases