I'm trying to build out the requirements for the PHP Plugin with CodeIgniter as the SSO provider, and I feel like I'm really close - but it just doesn't quite work. I can see that the credentials pass to Flarum on user login, but when navigating to Flarum the user is not logged in and the only cookie is flarum_session.

Here's my code; this is all on my local/test server, so the keys and tokens don't matter:

// Shield to Flarum integration
Events::on('login', function ($user) {
    $request = service('request');

    $password = $request->getPost('password');
    $remember = ($request->getPost('remember') === 'on') ? true : false;

    $flarum = new Flarum([
        'url' => 'http://flarum.home-nas',
        'root_domain' => 'flarum.home-nas',
        'api_key' => 'v5vxq5rrPVLgmddjZgYf4nngzeWyy3YfDB56rk5w',
        'password_token' => 'k%RG*sG?N!_F~x62{@CjhHtrpcamHyXsf=P%Uj43\Ze!\qU9G}|RsQPG{6K',
        'verify_ssl' => false,
        'remember' => $remember
    ]);

    /** 
     * Flarum usernames are not email addresses, and the SSO plugin complains with emails. 
     * If the username doesn't exist, we need to create a username from the email address, 
     * else grab it from the CodeIgniter user object
     */

    $usernameonly = substr($user->email, 0, strpos($user->email, "@"));
    $cleaned_up = preg_replace("/[^A-Za-z0-9 ]/", '', $usernameonly);

    $flarum_user = !empty($user->username) ? $flarum->user($user->username) : $flarum->user($cleaned_up);

    //User details
    $flarum_user->attributes->email = $user->email;
    $flarum_user->attributes->password = $password;
    //$flarum_user->attributes->is_email_confirmed = true; /* is_email_confirmed is undefined in intelephense */

    // Login the user with username
    $flarum_success = $flarum_user->login();
    if ($flarum_success) {
        log_message("notice", "flarum thinks it worked");
    } else {
        log_message("notice", "flarum thinks it failed.");
    }
});

I hate to bump threads if at all possible, but I'm at a loss of what could be wrong. Should I post this question in another place?