PHP and WordPress Single Sign On (SSO) with optional JWT Addon

Artuu

maicol07 If AddClientAssets.php file is not used in any way, it can be deleted.

maicol07

Artuu I will see what this file do and if it is unused I will delete it

gus

It doesn't work for me.
You rename the class Forum by Flarum change but you didn't change it in index.php and logout.php.
Regardless of this, I can't make it works. Is it working for you ?

maicol07

gus Example website is not currently updated. For now, refer to class methods comments. If you have any questions please tell me. I'll update the example website soon

gus

Ah ok thank you.
I have this error when sendRequest() is called :

Warning: file_get_contents(/api/token): failed to open stream: No such file or directory in ...

Warning: file_get_contents(/api/users): failed to open stream: No such file or directory in ...

I wonder if the problem comes from my server, do you have an idea ?

maicol07

gus Do you have added your Flarum URL into config,php?
I've noticed now there is a little bug that blocks request sending.
New version fixing it should be out in minutes...

maicol07

1.3.2 - Critical fixes

This release includes some critical fixes that caused the extension to not work.

Changelog

Major changes are marked with ❗️

❗️ Critical fixes that caused the extension to not work.
Updated sample website example

Updating

Run composer update command or use Bazaar

gus

maicol07 , thanks for answer, yes I didn't update config.php (return (object) was missing).
But I have another problem ! ☹️

The function file_get_content() always returns :
You don't have permission to access /api/token on this server.

Here is the header :
array(1) { ["http"]=> array(4) { ["header"]=> string(71) "Authorization: Token myToken; userId=1" ["method"]=> string(4) "POST" ["content"]=> string(91) "password=f3ccb2b2c2f17dcdfa849cd7e33d50371ad3d98e3d939311e21de9211ed9bc2e&lifetime=31536000" ["ignore_errors"]=> bool(true) } }

However, the api key is the same in the database, do you know why it doesn't work ?

maicol07

gus have you set your user ID along with your token in the api_keys table?

gus

maicol07 Of course !

<?php
return (object) [
    // URL to your Flarum forum
    'flarum_url' => 'https://forum.mywebsite.fr',
    // Domain of your main site (without http://)
    'root_domain' => 'mywebsite.fr',
    // Create a random key in the api_keys table of your Flarum forum
    'flarum_api_key' => 'myToken',
    // Random token to create passwords
    'password_token' => 'myToken',
    // How many days should the login be valid
    'lifetime_in_days' => 365,
];

(myToken contains letters and digits)

gus

Yes, here is what I added in the api_keys table :

key : myToken
id : 1
allowed_ips : NULL
scopes : NULL
user_id : 1
created_at : 2019-10-16 00:00:00
last_activity_a : NULL

The user_id 1 is the admin

maicol07

gus May I see your config.php file?

maicol07

gus this should work. If you open Web Console (F12) --> Network when you do a request to Flarum you'll se a XHR request. Could you open it and send here the screenshot of that?
P.S.: Sorry for the late reply

gus

maicol07
There is no XHR request, I'm still trying to fix the issue, but I don't have any idea.

Here is the error : Warning: file_get_contents(https://forum.myWebsite.fr/api/token): failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden in...

YoungJinKim

maicol07 why sire:

Rootzilla

Where is "sample-website" folder and "config.php.dist" file. Can you tell in more detail please ?

maicol07

Rootzilla you can download the ZIP from GitHub. You will find the sample-website folder and, inside it, the config.php.dist

010101

I assume this still can only be used if you set up the forum using a subdomain? I just tried with a set up like this (Flarum installed in a folder called forum): mysite.com/forum and it didn't work. It's very sad. It means with this site I'll have to stick with a WordPress forum plugin and won't be able to use Flarum at this particular website. 😢 Sigh. Oh well. Maybe one day (2029?) someone will make a Flarum WordPress plugin which will work with more scenarios.

maicol07

010101 It should work. Where is located your WP and your Flarum?

010101

maicol07 It's OK, I already reversed / uninstalled everything and I have to leave the computer now... I've been on here too long.

Maybe I'll try it again one day. But, just so you know, the problem I experienced was I would log into my WordPress, then go to the forum and I wasn't logged in. I would click login at the forum and the page would just refresh with no changes. It wasn't detecting that I had logged in. I could of course go back to the WordPress site and was logged in. I followed the instructions... put the key in the database, set the user id to me (the admin), installed the plugin and updated the config with the key and my URLs. The URLs seemed to work OK... they redirected to the right places. It just wasn't picking up that I was logged in.

I know this doesn't help though because it could have been many different things.

Has anyone successfully used this with Flarum installed in a folder, not an actual subdomain?

maicol07

010101 That is a common problem (I've also experied this problem). The only solution is use a plain password with the login method and not the one hashed by PHP with the function password_hash. This because Flarum checks the plain password and not the hash (I think it checks the password by hashing it with password_hash, so if it hashes the password hash it obviously won't work). This is the solution I found without choosing another encryption method:

Click Login on Flarum
Check if user is logged in. If false, then login and when login successfull send a login request to Flarum with plain password. Otherwise, if user is already logged in, redirect to a page where user needs to enter the password to login correctly to Flarum.

I hope this answers your question.

Rootzilla

010101

I have that same problem. When I click the login button, it redirects to Wordpress and login but it seems that I have not logged in to Flarum.

ANWEN

010101 I'm also looking for a solution installed in a subdirectory（我也在找安装在子目录下的解决方案）.