PHP and WordPress Single Sign On (SSO) with optional JWT Addon

MirceaSilviuItu

maicol07 thanks. There really are a lot of 3rd party libraries requiring guzzle 6 still.

MirceaSilviuItu

maicol07 Oh, your flarum-sso-plugin is actually still requiring maicol07/flarum-api-client: dev-0.2.x-dev which ofc is still requiring guzzle 7

https://packagist.org/packages/maicol07/flarum-sso-plugin

maicol07

MirceaSilviuItu yes, I'm developing a new major version for the plugin. Should be out by the end of September

MirceaSilviuItu

maicol07 Ok I installed flarum-sso-plugin dev-master for now :\

MirceaSilviuItu

maicol07
How do I signup a user using the latest version?
Your old documentation says $flarum->login('username', 'email', 'password');
However I see that you moved the Basic trait to the User class and login() doesn't take any parameters now and I don't see how to load the attributes into the class when I want to signup a new user for example.

maicol07

MirceaSilviuItu documentation about the new version will be written soon. Stay tuned!

MirceaSilviuItu

maicol07 🤣 I'm just going to use the api through your plugin to make an api call with user, email and password then. I can't wait 😀

MirceaSilviuItu

Have you tested the logout functionality? Because I am not sure it works. I have my forum at forum.mysite.com and the flarum_session cookie is set for the domain forum.mysite.com which I don't think can be unset from .mysite.com

Moreover in order to unset a cookie, as specified here: https://packagist.org/packages/delight-im/cookie the new cookie object needs to have exactly the same properties as the existing cookie, but in the logout() method you have hardcoded some props like the path and HttpOnly and SecureOnly to true, which I'm not using as I'm developing locally.

maicol07

MirceaSilviuItu the logout feature works. Configuration parameters are the same as the old docs. So you need to set mysite.com as root domain. You can try the example to see how it works

MirceaSilviuItu

maicol07 I did but did you test your solution just when the forum is at mysite.com/forum/ or also when it's at forum.mysite.com ?
Because I don't think you can unset a cookie which was set from forum.mysite.com (set by the flarum application) from mysite.com (different php application). I think that would be a security issue?

I think in this scenario you would need a redirect from mysite.com -> Logout -> to forum.mysite.com to unset the session cookie there, then redirect back to mysite.com.

Or modify your flarum plugin to set the flarum_session cookie to .mysite.com instead of forum.mysite.com (but I'm not sure if Flarum supports that from within an extension?). Then it would work I imagine.

maicol07

MirceaSilviuItu I'll do some more tests and catch you soon

MirceaSilviuItu

The browser knows the cookie was set from forum.mysite.com so it wont accept a request to unset that cookie from mysite.com, I imagine?

maicol07

MirceaSilviuItu I've tested it. It seems that flarum adds a session cookie witht he subdomain... I should be able to fix this with the Flarum extension

maicol07

MirceaSilviuItu fixed, I hope!

ctml

In the login function for the php plugin, if the users password changes outside of flarum I get a 500 on next login. If I use a random constant string for the password for all users I've got no issues. Is this intentional? The changed password causes an error in the set_cookie function on line 160 in the plugin, the $token value is null.

maicol07

ctml what version are you using? Can you show the stack trace?

ctml

maicol07

"name": "maicol07/flarum-sso-plugin",
"version": "1.2"

I have some issues updating the suite (sso/api-client) due to guzzle conflicts with some other extensions, but it sounds like you have an update coming out soon which may address this.

maicol07

ctml yes, this should be fixed with the upcoming 2.0. Though you might not be able to update if you can't update to 1.2.2... (due to the guzzle conflicts... what guzzle version are you using? The API Client requires ^6 or ^7)

maicol07

Finally, after months of developing the new, biggest release has finally come!
To be honest, I had expected to release it in October, but other things got more priority than the extension (and its plugins).
Anyway, now, let me introduce the new releases:

Release 1.7 (Flarum extension)

Changelog

Major changes are marked with ❗️

➕ Added

🔥 ❗️ Added support to Beta 14 (now the extension requires beta 14 to run)
🔑 Compatibility with Json Web Tokens

⭐️ Improvements

📝 Revamped docs

🛠️ Fixed

🐛 ❗️ Fixed logout (#FSSOE-1)

Release 2.0 (PHP Plugin)

Changelog

Major changes are marked with ❗️
Breaking changes are marked with 💥
💥 Requires PHP 7.2+

➕ Added

💥 Hooks/Addons system. Now you can install addons and add them to the PHP plugin! This way they can customize the behaviour of the plugin and add additional features.
Compatibility with Laravel 8
💥 Changed constructor parameters format (now using an array)
💥 New User management (removed removeGroups() method. Edit user groups to remove them)
💥 getUsersList() now returns a Laravel collection instead of an array
getUsersList() now supports more than one filter
💥 The old insecure mode is now the Verify SSL option. Its behaviour has changed, so check the docs to know what has changed

⭐️ Improvements

Revamped examples
📝 Revamped docs
⚡️ Optimized login (should be faster)

🛠️ Fixed

🐛 Redirect not working when no URL scheme is specified

🔥 Removed

Removed setCookie() function

Release 2.0 (WP Plugin)

💥 Requires PHP 7.2+ and the JSON extension

➕ Added

All the changes from PHP plugin
✏️ When an user is updated, it will get updated in Flarum too
🎨 New settings page design
Detached plugin settings from addons ones
Supported login with email and password #FSSOE-11

⭐️ Improvements

📝 Revamped docs

🛠️ Fixes

🐛 ✉️ Can't update email #FSSOE-12
🚨 Exception on login in some cases #FSSOE-10

WP Plugin should be up in the WP plugins repo by today

New Addons

JWT SSO Premium addons are now available for PHP & WP plugins!
Check the docs to know how to get them!

How to upgrade?

Check the changelog and the new docs.

ctml

maicol07 Does 1.7 work with Beta 15?

« Previous Page Next Page »