auto login 1

[stasJohn]

Is the following possible?

A client runs a paid membership service. When a member joins, they are given a login/pass for multiple resources (websites).

Whats happening is, people are joining and passing the logins for these various websites to their peers, friends, etc.

So, the client wants an application where each user has a single login. Upon login they are presented with a page which lists the various sites they have available to them. Clicking a link will auto-log them into the website. This way, the member never knows the login details for each resource.

Is this possible? I thought curl was a solution, but realized curl doesn't quite work that way. Maybe ajax, but then all user/passes would be stored in an easy to view javascript file.

 

[jpadie]

have a database shared between all the different resources.
keep a login flag in that database that is set by the despatching page.

each link from the despatching page should have a unique id in it with which the receiving website can create a session or link the session to a user. the uid is also, of course, the key for the lookup to the foreign database.

you might take this solution one stage further and use a fully database driven session management system. sleipnir214 has posted the code for this in the FAQ to this site.

but note: cookies can't cross domains. you will need to set separate cookies for each domain and pass the uid in the url first time round.

 

[stasJohn]

Thanks for the response.

That would be a good solution, but unfortunately I have no control over these resources. These websites are other sites built by other people.

 

[jpadie]

how does the autologin to the foreign resources work then?

 

[stasJohn]

Thats my question.

 

[jpadie]

you have misunderstood.

how does each foreign resource manage automatic logins? do they have a rememberme function? do they deploy a specific cookie? how are their passwords handled? if they do not allow automatic logins do they use a changing password box field name to prevent autocompletion (or similar).

does your client have the *right* to resell logins to these foreign sites?

 

[stasJohn]

how does each foreign resource manage automatic logins? do they have a rememberme function? do they deploy a specific cookie? how are their passwords handled? if they do not allow automatic logins do they use a changing password box field name to prevent autocompletion (or similar).

I'm guessing thats what I need to do. Unfortunately I don't know what the sites are. Still waiting on the client to send the list.

So, it seems I have to figure out how each site does it and mimic it... if possible?

does your client have the *right* to resell logins to these foreign sites?

They're not actually reselling them. The client has deals with these (resource) websites that allow them to create new user accounts for members. By signing up through my client, the member gets some special perk on the(resource) website. When the member ends their membership, the user account is deleted from the (resource) website.

In a nutshell, membership with my client comes with memberships to a list of (resource) websites.

 

[jpadie]

you certainly need to know the login systems of those foreign websites otherwise you can't even start working out a solution to this thread.

if there is a deal in place between your client and these sites, can't you also integrate technically in some respects (viz my first reply).

 

[stasJohn]

you certainly need to know the login systems of those foreign websites otherwise you can't even start working out a solution to this thread.

Yes, so, it is possible to do this! but what php functions would help me with a solution?

if there is a deal in place between your client and these sites, can't you also integrate technically in some respects (viz my first reply).

I will look into this.

 

[jpadie]

i think the functions that you would use would entirely depend on the receiving site. in general cURL should work but the handoff to a direct browser-foreign resource website might be problematic (cookies). conversely rewriting everylink might also be a nightmare.

you could consider a frame solution and use the frame linked to your domain to control (by javascript) the logon to the other site. you could occlude the password a bit perhaps by using xmlhttprequest with some onetime encryption.

 

[stasJohn]

thanks for the suggestions. I'll research each more.

 

[jpadie]

no worries:
you might also consider configuring a server to act as a proxy.