Direct login check URL with fof/passport?

jmshorb

The issue

I am using fof/passport and it is working quite well for logging in, authenticating with our CAS setup and then signing users in with a generic username and letting them choose their nickname (kudos to the flarum-nicknames people!). My one issue is that we have a central launchpad/dashboard where many people access all of our services. They can only see our forum link when logged in, so they must be logged in prior to clicking on the link. Is there a URL that we could direct to in flarum that will authenticate immediately (or check for authentication)? It is bothersome for people to be logged in, click on the forum link, then have to click on the login button again with multiple modals and popups. I am thinking it may be some api request that can be tacked onto <flarum-site>/auth/passport but right now that just generates a code= and state= URL and does indeed log the user in but does not redirect to the home page.

Flarum information

Flarum core: 1.8.10
PHP version: 8.3.22
MySQL version: 10.11.15-MariaDB-ubu2204
Loaded extensions: Core, date, libxml, pcre, zlib, filter, hash, json, random, readline, Reflection, SPL, session, ctype, curl, dom, fileinfo, gd, gmp, iconv, intl, mbstring, openssl, PDO, standard, SimpleXML, sodium, tokenizer, xml, xmlwriter, zip, exif, mysqlnd, Phar, pdo_mysql, uuid, Zend OPcache
+-----------------------------------+---------+--------+
| Flarum Extensions                 |         |        |
+-----------------------------------+---------+--------+
| ID                                | Version | Commit |
+-----------------------------------+---------+--------+
| flarum-flags                      | v1.8.2  |        |
| flarum-tags                       | v1.8.4  |        |
| flarum-approval                   | v1.8.2  |        |
| askvortsov-auto-moderator         | v0.1.3  |        |
| flarum-suspend                    | v1.8.4  |        |
| flarum-mentions                   | v1.8.5  |        |
| flarum-subscriptions              | v1.8.1  |        |
| v17development-user-badges        | v1.1.0  |        |
| miniflar-admin-notepad-widget     | 1.0.0   |        |
| fof-user-bio                      | 1.4.2   |        |
| fof-upload                        | 1.8.8   |        |
| fof-subscribed                    | 1.1.4   |        |
| fof-socialprofile                 | 1.2.0   |        |
| fof-reactions                     | 1.4.1   |        |
| fof-polls                         | 2.3.1   |        |
| fof-passport                      | 1.1.1   |        |
| fof-pages                         | 1.0.8   |        |
| fof-moderator-notes               | 1.3.0   |        |
| fof-links                         | 1.4.0   |        |
| fof-follow-tags                   | 1.2.9   |        |
| fof-byobu                         | 1.4.3   |        |
| flarum-sticky                     | v1.8.2  |        |
| flarum-nicknames                  | v1.8.2  |        |
| flarum-markdown                   | v1.8.1  |        |
| flarum-lock                       | v1.8.2  |        |
| flarum-likes                      | v1.8.1  |        |
| flarum-embed                      | v1.8.0  |        |
| flarum-bbcode                     | v1.8.0  |        |
| clarkwinkelmann-group-invitation  | 1.0.2   |        |
| clarkwinkelmann-anonymous-posting | 1.1.1   |        |
| blomstra-fontawesome              | 0.1.5   |        |
+-----------------------------------+---------+--------+

KBExit

If you need a direct link to login, you can try the Direct Links extension.

clarkwinkelmann

KBExit I don't think it achieves what the OP is looking for

jmshorb that's not a feature built into Passport or the general oauth flow, but it can definitely be implemented with custom code. You will probably end up re-implementing most of the Passport feature if you go that route, as almost all of these solutions will be easier to implement if you manually create the user and set their attributes in your own code. You'll need something of either:

If the websites share the top level domain, you could configure Flarum so the auth cookie sits on the top level. Then when you login on the main website, you can call an endpoint on Flarum in the background to start a session, then set the global cookie as returned by Flarum
If the websites don't share a domain or it's impractical or insecure to share cookies, you need one of:
- Redirect through the Flarum domain on every login, with a no-interaction login URL, probably using some signed token from the main app
- Implement a client-side check when the forum opens, if not connected, attempt to auto-login and refresh the page
- If you cannot share the auth cookie but you can share another cookie, you could have Flarum redirect through the main domain when it sees that cookie

I implemented most of these options in my Wordpress integration extension, though unfortunately the code is not public.

If you want to try another ready-made solution that requires minimal code, maybe https://discuss.flarum.org/d/30632-json-web-token-cookie-login could be useful.

The SSO extension might also have some features to enable global login https://discuss.flarum.org/d/21666-php-and-wordpress-single-sign-on-sso-with-optional-jwt-addon

jmshorb

Thanks! I am bookmarking this for now as we test our first few weeks with the current set-up. We do share a top-level domain, so that makes things easier. The by-hand route would be difficult (at time of launch, we have over 20k users in our CAS system that need to have ready access through SSO).

We are also open to discussions of a paid solution, too. Especially if it extends the code for everyone else (I know there were bounties at one point that haven't been re-implemented here).