PHP and WordPress Single Sign On (SSO) with optional JWT Addon

maicol07

richstandbrook no worries! 🙂
Try to recreate the flarum user object after the login (it's a try, I want to see if this works)

richstandbrook

maicol07 Tried a completely isolated instance to call fetchUser() and it still returns false and debugging the code shows {"errors":[{"status":"404","code":"not_found"}]}

maicol07

richstandbrook does the login method return true? Because that 404 error ahs occurred because no user with that username exists on Flarum

richstandbrook

maicol07 so heres the rough code I'm trying:


$loginUser = new Maicol07\SSO\User('user', $flarum);
$loginUser->attributes->email = 'me@example.com';
$loginUser->attributes->password = 'secureme';
dump($loginUser->login());

$getFlarumUser = new Maicol07\SSO\User('user', $flarum);
dump($getFlarumUser->fetchUser());

dump($getFlarumUser);

The output I get is:

true
false
Maicol07\SSO\User // object with nothing but attributes->user set to 'user'

The user is in the database just fine

maicol07

richstandbrook have you updated the plugin to the latest version? I've tried locally and it works... also make sure to have enabled the verify_ssl option if you are trying it locally

ctml

DrSchizo

I achieve this by using a single 'master' password when 'signing users up' during SSO login. Of course this key needs to be kept private, only in your code or better read from a private file / key / env variable.. something long and secure.

maicol07

ctml that was the behaviour of the 1.x versions and was removed due to security issues

ctml

maicol07 below is what I am doing. User passwords change from time to time, and there is no event I can capture when that happens to keep flarum DB up to date so I resorted to doing the below.. as long as I keep master key private it's not really an issue, same could be said for any token/password that provides administrator level access though.

"name": "maicol07/flarum-ext-sso",
"version": "1.8.1"

"name": "maicol07/flarum-sso-plugin",
 "version": "2.0",

$flarum_user->attributes->email = $user__email;
$flarum_user->attributes->password = '<master_key_>';
$flarum_user->login();

ctml

There seems to be an issue with routing when SSO is enabled. Any extensions which register routes after SSO will not work. For example if you use the blog and enable it after SSO then loading /blog directly without navigating from flarum will cause a 404. If you disable SSO and re-enable, all will work again though so at least there is a workaround 🙂

maicol07

ctml 🤔 I'll investigate on this

Bishwas-py

maicol07 Isn't it used to connect two flarum forum for login? Can a user login with same details in main_forum.com to forum2.main_forum.com?

maicol07

Bishwas-py not at the moment, though there is an issue in the tracker (currently offline because I'm requesting the Open Source License renewal). There isn't any ETA for that since it's a minor feature for the extension. You can always commissionate it if you need it

SportDevAdam

@maicol07 I have just installed a fresh Flarum (beta 16) and I cannot get the extension to install. I get this error:

Problem 1
    - maicol07/flarum-ext-sso[1.8, ..., 1.8.1] require flarum/core >=0.1.0-beta.15 <0.1.0-beta.16 -> found flarum/core[v0.1.0-beta.15] but the package is fixed to v0.1.0-beta.16 (lock file version) by a partial update and that version does not match. Make sure you list it as an argument for the update command.
    - Root composer.json requires maicol07/flarum-ext-sso ^1.8 -> satisfiable by maicol07/flarum-ext-sso[1.8, 1.8.1].

I thought it might to do with beta 16 compatibility, so I reinstalled Flarum using Beta 15 and I get the same error. Any ideas?

maicol07

SportDevAdam yeah, I need to get the extension compatible with the newest beta (installing it is blocked until the extension becomes compatible).
It should install without issues on beta 15. Are you sure you have the flarum/core dependency locked at 0.1.0-beta.15 in composer.json?

SportDevAdam

@maicol07 thanks, I got it installed on beta 15. I hadn't realised that I had to do a no-install, then lock flarum/core and then update the dependencies.

However, I have a problem. When a user attempts to reset their password, after they enter their username or email address and click "Get new password" a fatal error occurs:

Fatal error: Uncaught GuzzleHttp\Exception\ClientException: Client error:PATCH http://local.mydomain.com/forum//api/usersresulted in a405 Method Not Allowedresponse: {"errors":[{"status":"405","code":"method_not_allowed"}]} in /Users/Adam/Sites/teammk2021-2/wp-content/plugins/sso-flarum/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php:113 Stack trace: #0 /Users/Adam/Sites/teammk2021-2/wp-content/plugins/sso-flarum/vendor/guzzlehttp/guzzle/src/Middleware.php(69): GuzzleHttp\Exception\RequestException::create(Object(GuzzleHttp\Psr7\Request), Object(GuzzleHttp\Psr7\Response), NULL, Array, NULL) #1 /Users/Adam/Sites/teammk2021-2/wp-content/plugins/sso-flarum/vendor/guzzlehttp/promises/src/Promise.php(204): GuzzleHttp\Middleware::GuzzleHttp\{closure}(Object(GuzzleHttp\Psr7\Response)) #2 /Users/Adam/Sites/teammk2021-2/wp-content/plugins/sso-flarum/vendor/guzzlehttp/promises/src/Promise.php(153): GuzzleHttp\Promise\Promise::callHandler(1, Object(GuzzleHttp\Psr7\Response), NULL) #3 /Users/Adam/Sites in /Users/Adam/Sites/teammk2021-2/wp-content/plugins/sso-flarum/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php on line 113

If I switch off SSO, the error goes away. Any idea how to fix this?

maicol07

SportDevAdam that's a very strange issue without an absolute fix. Someone solved it by upgrading their MySQL/MariaDB version, others by checking if the ISP was blcking PATCH requests. Try these two first; then, if the issue persists, we'll investigate this with the Flarum team

maicol07

tankerkiller125 askvortsov I send a PATCH request to the api/user/{id} (now that I'm noticing it, the strange thing is that the endpoint of SportDevAdam is api/users that I don't think supports a PATCH request) and it's wrong. Tomorrow I'll check it in the code and see if I find sommething wrong

maicol07

This time, since release notes are bigger than the previous releases, I'll add the links to the changelog and upgrading guide (if exists). Tell me if you like this format and you want it for the next releases and the new changelog format in the docs.

Release 1.9 (Extension)

📝 Changelog

Release 3.0 (PHP Plugin)

There are some breaking changes in this release, so be sure to check the upgrade guide below.
📝 Changelog
🔖 Upgrading guide (Version specific upgrade notes)

Release 2.1 (WP Plugin)

WP plugin will take a little longer to come up as update. ~~Wait 10 minutes or so from now~~ WP SVN has some issues, I'll try to upload the new version to WP repo tomorrow. If you want to upgrade use the manual method explained in the installation docs.

✨ Update to PHP plugin v3
🐛 Fixed a bug where deactivating the plugin from WP dashboard caused a fatal error (FSSOE-16)

All the addons of the two plugins have been updated to support beta16 and its plugin changes

UaMV and SportDevAdam please try this new version to see if your issue is fixed

askvortsov

maicol07 I'll note that you can use POST methods and an x-http-method-override header instead of patch/delete, and Flarum will recognize that: https://github.com/flarum/core/blob/1b5b143930af722fa367296d51a7dcfb12c04f07/src/Api/Middleware/FakeHttpMethods.php#L17-L17

tankerkiller125

maicol07 I'm not sure how your extension works exactly, but the workaround that we've used in the past for some things is to set the X-HTTP-METHOD-OVERRIDE header. With PATCH as the value.

The actual method used would then be POST at least on the frontend side of things. The backend would still be a "patch" method.

This method works with Flarum and Wordpress.

UaMV

maicol07 I was hitting that same api/users endpoint earlier when trying to integrate via WP. I never get around to investigating further or solving it.

UaMV Any idea what might fix this error?

Client error: `PATCH https://[radacted].com/api/users` resulted in a `405 Method Not Allowed` response:
{"errors":[{"status":"405","code":"method_not_allowed","detail":"Flarum\\Http\\Exception\\MethodNotAllowedException: PAT (truncated...)

I'm using the WP plugin with subdomain integration for the Flarum instance.
…

That earlier report shows some of the requests leading up to that, I think. Maybe helpful as you hunt.

« Previous Page Next Page »