PHP and WordPress Single Sign On (SSO) with optional JWT Addon

maicol07

UaMV the API client should be automatically installed when you install the PHP plugin. If you are using WordPress you need manually to run this command to update the Composer dependencies in the plugin directory or wait the next update (I don't know when it will be released):

composer update --no-dev --prefer-dist

The same command can be used with the PHP plugin

Safinn

Hello. I wondering if this extension works with any Auth system or is is specifically for Wordpress? Is it a case of redirecting back to the flarum for it to work?

maicol07

Safinn no, this extension is made by 2 parts, that works toghether:

Flarum extension: the one that actives signed up users and manages JWT auth (this one is a premium addon, see below). You can install it with composer require flarum-ext-sso on your Flarum
A client plugin: for the moment there are only two plugins: PHP and WordPress. The first one is a generic PHP plugin, means you can use it with any app/framework written in PHP (you can also use this on WP if you don't want to use the official one); the latter is the PHP plugin implementation for WP. This means it isn't specifically for WP
- The latest components is the addons. These are additional features, either free or paid, for plugins, such as the Groups or the JWT addon.

You can find all the details in the docs (link in the first post).
Ask me any question if you have! 😉

Safinn

maicol07 Thanks for the information. I didn't realise it was in 2 parts. So I have the extension installed (does premium mean its paid?) on my flarum instance. My auth system is in Node.js. That means I would need to have a JS client plugin right?

maicol07

Safinn So I have the extension installed (does premium mean its paid?) on my flarum instance.

where do you see premium?

Safinn My auth system is in Node.js. That means I would need to have a JS client plugin right?

Yes. If you want to make it open source and follow how the PHP plugin is written, I can add your plugin to the docs. If you're interested write to me on Telegram (link to my profile in my website: https://maicol07.it) or Discord (find me on the Flarum discord)

richstandbrook

richstandbrook I'm developing on my local machine, domains mapped to the localhost, no firewalls. Should the login method return the ID of a new user? How can I get the ID of a newly registered user?

maicol07

richstandbrook no, the login (and signup) methods returns a bool value: it indicates if the user has been correctly logged in or signed up. To get the ID of the new Flarum user you need to use the fetchUser() method and then get the ID property: $user->id

richstandbrook

Sorry, maicol07 we seem to be keeping you busy here. I perform the login() which seems to work, but when I run fetchUser() it returns false!

$flarumUser = new User($username, $this->flarum);
$flarumUser->attributes->email = $email;
$flarumUser->attributes->password = $password;
$flarumUser->login();

$flarumUser->fetchUser(); // is false

Edit: Maybe the issue you've noticed before (https://discuss.flarum.org/d/21666-php-and-wordpress-single-sign-on-sso-with-optional-jwt-addon/375) that the /api/users/ endpoint is giving 404 for usernames.

DrSchizo

Hi,

If you change the login et signup addresses, the buttons "Start a discussion" and "Log in to reply" are working properly and open the new entered URLs. But if you hide the "Sign up" and "Log in" buttons, those links open then the regular Flarum Log In popup, and not the entered URLs. The work-around solution I found is to hide the "Sign up" and "Log in" buttons in CSS (display:none), not through the admin panel. Is there something I am missing or is that a bug I found?

Also, I'm using the php plugin and would like to be able to log in to Flarum without entering a password. Is that possible?

Instead of doing this:

$flarum_user = new User($username, $flarum);
$flarum_user->attributes->password = $password;
$success = $flarum_user->login();

Simply doing this:

$flarum_user = new User($username, $flarum);
$success = $flarum_user->login();

Indeed, I want to be able to log in to Flarum at any time, not only during my website log in process. But once the user is already logged in to my website, I don't have access to the user password anymore since it is encrypted.

Thanks a lot!

maicol07

DrSchizo yes, that's a bug. It will be fixed. If you can, please report it in the bug tracker: https://tracker.maicol07.it

You can't login without the password. That's required since it's needed to get the user token. What you want is achieved by the premium JWT add-on: https://docs.maicol07.it/en/flarum-sso/plugins/php#jwt-premium

ctml

DrSchizo

I achieve this by using a single 'master' password when 'signing users up' during SSO login. Of course this key needs to be kept private, only in your code or better read from a private file / key / env variable.. something long and secure.

maicol07

richstandbrook no worries! 🙂
Try to recreate the flarum user object after the login (it's a try, I want to see if this works)

richstandbrook

maicol07 Tried a completely isolated instance to call fetchUser() and it still returns false and debugging the code shows {"errors":[{"status":"404","code":"not_found"}]}

maicol07

richstandbrook does the login method return true? Because that 404 error ahs occurred because no user with that username exists on Flarum

richstandbrook

maicol07 so heres the rough code I'm trying:


$loginUser = new Maicol07\SSO\User('user', $flarum);
$loginUser->attributes->email = 'me@example.com';
$loginUser->attributes->password = 'secureme';
dump($loginUser->login());

$getFlarumUser = new Maicol07\SSO\User('user', $flarum);
dump($getFlarumUser->fetchUser());

dump($getFlarumUser);

The output I get is:

true
false
Maicol07\SSO\User // object with nothing but attributes->user set to 'user'

The user is in the database just fine

maicol07

richstandbrook have you updated the plugin to the latest version? I've tried locally and it works... also make sure to have enabled the verify_ssl option if you are trying it locally

maicol07

ctml that was the behaviour of the 1.x versions and was removed due to security issues

ctml

maicol07 below is what I am doing. User passwords change from time to time, and there is no event I can capture when that happens to keep flarum DB up to date so I resorted to doing the below.. as long as I keep master key private it's not really an issue, same could be said for any token/password that provides administrator level access though.

"name": "maicol07/flarum-ext-sso",
"version": "1.8.1"

"name": "maicol07/flarum-sso-plugin",
 "version": "2.0",

$flarum_user->attributes->email = $user__email;
$flarum_user->attributes->password = '<master_key_>';
$flarum_user->login();

ctml

There seems to be an issue with routing when SSO is enabled. Any extensions which register routes after SSO will not work. For example if you use the blog and enable it after SSO then loading /blog directly without navigating from flarum will cause a 404. If you disable SSO and re-enable, all will work again though so at least there is a workaround 🙂

maicol07

ctml 🤔 I'll investigate on this

Bishwas-py

maicol07 Isn't it used to connect two flarum forum for login? Can a user login with same details in main_forum.com to forum2.main_forum.com?

« Previous Page Next Page »