The Arcive of Official vBulletin Modifications Site.It is not a VB3 engine, just a parsed copy! |
|
Single Signin / Login Integration Tip
Hi people, first post here, hope its useful I've just installed vbulletin on a client site as they needed a forum/discussion facility and vbulletin provided good moderation facilities. They wanted existing users who were logged into the site not to have to log in again in order to use vbulletin. I noticed there wasnt much help for this on the forum and quite a few posts asking how it could be done. Since I have solved part of the problem I thought it might be useful to share it with you. Essentially the problem is to log in an existing user into vbulletin outside of the vbulletin environment so that when they access a vbulletin page it recognises them. This, as you might imagine involves the use of cookies. The way I have gone about it is to create an authentication handler in apache to be triggered when anyone tries to access a vbulletin page (i have vbulletin installed under /vb/) Since we are using mod_perl, the httpd.conf directive looks a bit like this... <Location /vb/> AuthType BLAHType AuthName BLAHName PerlAccessHandler BLAH->login_to_vb </Location> So.. when a user asks for a vb page, first it runs the login_to_vb method in module BLAH. (but you could probably make this a php page or something else) the login_to_vb script routine works as follows 1) it gets the currently signed in username and password (this will depend on the authorisation your website uses 2) it POSTs this information to /vb/login.php. In perl I do it like this... my $browser = LWP::UserAgent->new; my $response = $browser->post( $url, [ vb_login_username=>$user, vb_login_password=>$pass, do=>'login'); 3) It reads the cookies from the header recieved back and the places them into the outgoing headers.. my $header = $response->headers; my @cookies = $header->header('Set-Cookie'); foreach my $c (@cookies) { $r->headers_out->add('Set-Cookie',$c); } 4) Finally, it redirects the user to the page they were trying to access. my $redir_url = "http://".$r->hostname.$r->uri; my $pathinfo = join '&', ( map { "$_=$args->{$_}" } keys %{$args} ); $redir_url.= "?$pathinfo" if $pathinfo; $r->headers_out->add("Location" => $redir_url); $r->status(302); $r->send_http_header; Apache::exit; BUT.. there is a problem... vbulletin is clever, when you login, it registers your IP address against the session it creates for you. Next time you hit a vbulletin page it checks your IP against that session to make sure it is handing it back to the correct user. If you look at the file includes/class_core.php you will find a SQL query around line 2460 that looks mostly like this... if ($session = $db->query_first(" SELECT * FROM " . TABLE_PREFIX . "session WHERE sessionhash = '" . $db->escape_string($sessionhash) . "' AND lastactivity > " . (TIMENOW - $registry->options['cookietimeout']) . " AND ( ( host = '" . $this->registry->db->escape_string(SESSION_HOST) . "' AND idhash = '" . $this->registry->db->escape_string(SESSION_IDHASH) . "' ) OR host = '".$_SERVER['SERVER_ADDR']."' ) ")) { If you modify the query to what I have here, the server will happily let you log in if the session originally came from the server IP address, regardless of the IDHASH or HOST address. This reduces security a little bit so if you are very security conscious you might need to adjust this to suit you better. What else? Well, you don't really want the script to log you in EVERY time you access a vB page - bit excessive. So I set an extra cookie with a timestamp and only log in if a certain time has passed since it last logged you in. I set this interval just lower than the timeout set in vbulletin so that it logs you back in just before the vbulletin timeout kicks in. You can hard code this or pull it out of the vbulletin database settings. Obviously this just handles the login process.. You will need to find a way to keep the users details in sync. There are instructions for editing users details remotely on this site so I dont really need to cover that. One way though, would be to turn off user profile/password editing in the bulletin software and simply update the vbulletin user database from your existing application. To make updates to the vbulletin user database you need to create a php file (say /vb/updateVB.php within your vb directory that you can call upon to make changes to the user table. It would probably start something like this.. require_once('./global.php'); require_once('./includes/class_dm.php'); require_once('./includes/class_dm_user.php'); $userdm = new vB_DataManager_User($vbulletin, ERRTYPE_ARRAY); $userdm->set('username', qpc_post('username')); $userdm->set('password', qpc_post('password')); etc... Then from your application you can make GET requests to your script eg: /vb/updateVB.php?do=new_user&username=blah&password=bl ah Hope someone finds this of use. regards, Tom |
#12
|
|||
|
|||
Quote:
He has a site first, then Vb. Not theother way round. That link doesn help at all. |
#13
|
|||
|
|||
Just curious, what perl script?
Quote:
Orbita, I really like your approach. It's really clean (and would reduce my code a lot!). I recently did a single sign-on for a site which included the site, vbulletin and mediawiki. Mediawiki uses PHP sessions, as opposed to cookies. I'm still puzzling how to tell if the user is logged into the site, vbulletin and mediawiki without checking every request (which I'm not doing, it would be extreme overhead). I guess since the scenario described in your post only involves cookies, it's easy to set them all to expire at the same time so you don't have the session vs. cookie expiry synch issue I'm experienceing. Any ideas on that? I had a lot of issue with the sessions in the VB integration which is why I chose the same method of using LWP::UserAgent to post to the registration and login scripts in VB. To do registration, I created a form and corresponding script that processes the form and posts to the registration scripts for vbulletin and mediawiki using LWP::UserAgent. Same as login. It's a challenge though, because 3.6.4 changed the registration logic slightly and now I need to figure out how to accomodate the new logic. It looks like VB registration is now looking for a MD5 hash in the post to register. Upon registration, the last bit of my custom code creates what I'm calling an 'application username' and 'application password'. The values are whatever the user registers with. These are used for the login, no matter how many times the user might change their password. So when a user registers, their password is hashed into the 'password' and 'app_password' columns in my custom users table. When the user logs in, I check the submitted password against the 'password' column, then the 'app_password' is retrieved and used for the login request. To handle the user profile information in vbulletin, I created a plugin that redirects the user to the site account page if they try to update their username or password. Updating both my app's users table and the vb_users table seemed both troublesome and a lot of work for this critical component. Mediawiki turned out to be a lot easier once I wrapped my head around it. It has 'hooks', so I was able to write an Authentication plugin (called Authplugin in MW) that was a lot simplier. I set up a php script to read my site cookie and set a variable. If the variable is empty (the user isn't logged in) it authenticates the user using the site cookie. It would be a heck of a lot easier to integrate Vbulletin if it had an authentication hook like this. Or maybe there is a way to do it that I haven't yet realized? There is the global_start for plugins. Diona |
#14
|
|||
|
|||
does anyone have any idea how to integrate a login system of a different php script with vbulletin? meaning that users who login to the other script, can login to vbulletin too without having to re-register to vbulletin.
thanks |
#15
|
|||
|
|||
Quote:
login.php PHP Code:
config.php PHP Code:
John Goh |
#16
|
|||
|
|||
i was trying to do this to login:
http://mysite.com/login.php?vb_login..._password=blah but this doesnt do anything, anyone know why? |
#17
|
||||
|
||||
Quote:
|
#18
|
|||
|
|||
i search for it for a very long time! thanks orbita!
now....did anyone try it on vbulletin 3.7? |
#19
|
|||
|
|||
Quote:
[edit] Nvm, I'm not using two separate user databases |
Thread Tools | |
|
|
X vBulletin 3.8.12 by vBS Debug Information | |
---|---|
|
|
More Information | |
Template Usage:
Phrase Groups Available:
|
Included Files:
Hooks Called:
|