samtay Posted July 19, 2007 Share Posted July 19, 2007 Hey Everyone, Is it possible to implant single sign on with only using PHP, if so can you give me idea on how to do this? Oh it has to be Multi Domain and also the Domain will be unknown. Cheers Samuel Quote Link to comment Share on other sites More sharing options...
simcoweb Posted July 20, 2007 Share Posted July 20, 2007 Need some clarification. Sign on to what? Quote Link to comment Share on other sites More sharing options...
samtay Posted July 20, 2007 Author Share Posted July 20, 2007 Sign on to the site, in other words login. Cheer for the reply! Samuel Quote Link to comment Share on other sites More sharing options...
simcoweb Posted July 20, 2007 Share Posted July 20, 2007 I don't see how it could be done. Normally you'd use sessions or cookies and those don't go across domains. It would also need to query multiple databases assuming each login info is stored in one. Quote Link to comment Share on other sites More sharing options...
benjaminbeazy Posted July 20, 2007 Share Posted July 20, 2007 u'd need to keep track of sessions on multiple domains via an access/session security script and have each of them update a logged in table keeping track of ip, session ids, time, etc.. time consuming to set up Quote Link to comment Share on other sites More sharing options...
samtay Posted July 20, 2007 Author Share Posted July 20, 2007 The different sites uses the same database. What I have come up with is: Secondary Site checks if cookie token id is set. If set then checks if token is in database, checks if correct IP. If correct updates a timestamp in database to stop token expiring, this will stop abandoned token clotting the database up. [*]If not set then redirects to Main Site's login page. [*]Main Site will check if cookie token id is set. If set then checks if token is in database and checks if correct IP. If correct then sets cookie for secondary site and redirects back. If not correct displays login form. [*]If not set then displays login page. [*]The login page will check credentials If correct then token will be created in the database, cookies for Main Site and Secondary Site will be set and redirected. [*]All logins will be done on Main Site's login page. Do you think this idea should function correctly and securely? Cheers Samuel Quote Link to comment Share on other sites More sharing options...
benjaminbeazy Posted July 20, 2007 Share Posted July 20, 2007 should work, but use sessions, cookies can be disabled by the client Quote Link to comment Share on other sites More sharing options...
cooldude832 Posted July 20, 2007 Share Posted July 20, 2007 Not at all You can do it to say set your sessions on all sites the cURL() will allow you to send info to forms, however any reasonable site will make sure the htpp refer is the actual processing page and not some secondary page that you are attempting to hack login from. But cURL() can do it. You have a page Username/Password then on the processor it sends those off to the login processes on the sites you want to login on with those in the send. Quote Link to comment Share on other sites More sharing options...
samtay Posted July 20, 2007 Author Share Posted July 20, 2007 Not at all You can do it to say set your sessions on all sites the cURL() will allow you to send info to forms, however any reasonable site will make sure the htpp refer is the actual processing page and not some secondary page that you are attempting to hack login from. But cURL() can do it. You have a page Username/Password then on the processor it sends those off to the login processes on the sites you want to login on with those in the send. I'm not quite clear on your idea, do you mean to have a login page on the secondary site then the details be sent and processed on the main site? Wouldn't then I have to login in at each site as the domain are unknown? Quote Link to comment Share on other sites More sharing options...
cooldude832 Posted July 20, 2007 Share Posted July 20, 2007 Nope this is what you do form.html <html> <form action="process.php"> <input type="text" name="username" /> <input type="password" name="password" /> <input type="submit" value="Login" /> </form> Now that is simple, but the hard part is on page 2 which is all about php process.php <?php $logins = array( "https://www.google.com/accounts/ServiceLoginAuth?service=mail"; "http://www.yahoo.com"; ); //You can add more logins just use the processers $username = trim($_POST['username']); $password = trim($_POST['password']); foreach($logins as $value){ $ch = cURL_init($value); //Read cURL libray on sending the info to the pages curl_close($ch); } ?> Note: This might be do able with the http library, but that doesn't help you with ssh connections http://us2.php.net/manual/en/ref.http.php Quote Link to comment Share on other sites More sharing options...
samtay Posted July 20, 2007 Author Share Posted July 20, 2007 Ahhh kk, Well I'm unsure if its the right solution for me as I'm looking at have over 50 domains and would slow logining in really down. How my application works is that when a user registers they get a simple CMS and they can use their own domain with it. All the domain as send to the same virtual host on a Apache server, then depending on the domain the application will display the correct data. Cheers Samuel Quote Link to comment Share on other sites More sharing options...
samtay Posted July 20, 2007 Author Share Posted July 20, 2007 however any reasonable site will make sure the http refer is the actual processing page and not some secondary page that you are attempting to hack login from. I understand what you mean but the login page and the processing will be all done at the main site so what I have the same problem? Cheers Samuel Quote Link to comment Share on other sites More sharing options...
cooldude832 Posted July 20, 2007 Share Posted July 20, 2007 Yes on some homebrew sites it could be done easily, but for any thing professional there are certain parameters that would need to be followed. I know it can be done because ebay has it Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.